ISO 27001 Lead Auditor case studies

ISO 27001 Lead Auditor · Put your knowledge to work in context.

The PECB Certified ISO/IEC 27001 Lead Auditor credential is aimed at professionals who plan, lead and report on Information Security Management System (ISMS) audits against ISO/IEC 27001, applying ISO 19011 guidelines and the ISO/IEC 17021-1 certification process. The qualifying exam is the final step of the five-day Lead Auditor training course, which moves from ISMS and ISO/IEC 27001 fundamentals, through audit principles and preparation, on-site audit activities, and audit closure, with the exam held on day 5. The ISO 27001 Lead Auditor case studies are 6 cases and about 4,384 words.

The 93-Control ISMS That Skips Its Own Risk Process

Northwind Logistics has 620 employees and was certified to ISO/IEC 27001 eight months ago. The ISMS scope statement reads: "all logistics and customs-clearance services at the Rotterdam and Antwerp hubs".

725 words, about 4 min 2

The Internal Auditor Who Used to Run the Helpdesk

During an internal audit of the access-management process at a 180-person software company, the auditor - who managed the IT helpdesk she is now auditing until four months ago - interviews two service-desk agents. She pulls 15 of the 2,400 quarterly access-review records, all from Q1, and finds 3 in which the reviewer and the approver are the same individual.

729 words, about 4 min 3

Three Sites, Ten Days, and a Client Who Wants Two Hours

Cygnus Health runs a 24/7 patient-booking platform from a Frankfurt data centre, a development office in Kraków (180 of 900 staff), and a support office in Manila. You are planning the Stage 2 certification audit.

726 words, about 4 min 4

Fourteen Months of Untested Backups and a Risk Acceptance Nobody Approved

It is day 3 of a 5-day Stage 2 audit. While interviewing a backup administrator, you learn that nightly database backups to tape have not been restore-tested since the platform went live 14 months ago, although procedure BKP-04 requires a quarterly restore test.

724 words, about 4 min 5

Closing the Major: A Photo, a Procedure, and Two of Four Staff

It is the final day of a certification audit at a 300-person payment processor. The team raised one major nonconformity (restore testing not performed for 14 months against the organization's quarterly requirement) and five minor nonconformities.

738 words, about 4 min 6

A Three-Year Cycle for a Group That Just Bought 40% of Its Billing

Greenline Group has four business units: retail energy, metering services, IT shared services, and a billing company acquired eleven months ago. The group ISMS internal audit programme, approved by the CISO, schedules each unit once every three years at two auditor-days each, using a pool of four internal auditors.

742 words, about 4 min