Based on scenario 5, after migrating to cloud, Operaze’s IT team changed the ISMS scope and implemented all the required modifications. Is this acceptable?
A.
Yes, because the ISMS scope should be changed when there are changes to the external environment
B.
No, because the company has already defined the ISMS scope
C.
No, because any change in ISMS scope should be accepted by the management
While changes to the environment (like cloud migration) can necessitate a change in the ISMS scope (making option A partially correct in principle), the process matters. Defining and modifying the ISMS scope is a strategic decision that requires top management oversight and approval according to ISO/IEC 27001 principles (Clause 5.1). The scenario implies the IT team made this decision unilaterally ("the IT team... decided"). Therefore, the action as described is likely not acceptable because it bypasses necessary management approval. The answer is C.
While changes to the environment (like cloud migration) can necessitate a change in the ISMS scope (making option A partially correct in principle), the process matters. Defining and modifying the ISMS scope is a strategic decision that requires top management oversight and approval according to ISO/IEC 27001 principles (Clause 5.1). The scenario implies the IT team made this decision unilaterally ("the IT team... decided"). Therefore, the action as described is likely not acceptable because it bypasses necessary management approval. The answer is C.
While changes to the environment (like cloud migration) can necessitate a change in the ISMS scope (making option A partially correct in principle), the process matters. Defining and modifying the ISMS scope is a strategic decision that requires top management oversight and approval according to ISO/IEC 27001 principles (Clause 5.1). The scenario implies the IT team made this decision unilaterally ("the IT team... decided"). Therefore, the action as described is likely not acceptable because it bypasses necessary management approval. The answer is C.
A is correct : because the hosting was moved from On Premise hosting to Cloud Computing supplied by a 3rd party infrastructer supplier . This is a significant change impacting information security and requires the ISMS scope to be updated .
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
bb43b7c
2 weeks, 2 days agosomkiatr
2 months agosomkiatr
2 months agosomkiatr
2 months agoSay754
2 months, 3 weeks agoCHUEY
4 months, 2 weeks ago