Shared Reception, Lost Badges and an Unencrypted USB
A 120-person design studio leases two floors in a shared building. Reception is shared with three other tenants, and the landlord's cleaning contractor holds a master badge. An audit found 14 staff badges unaccounted for, employees regularly leaving unlocked laptops at their desks, and printed client prototypes left on shared printers overnight. A contractor lost an unencrypted USB stick containing 3,000 client photos in a cafe. The studio has no clean-desk policy and only one slide on security awareness at induction. A major client requires evidence of physical and people controls before renewing a contract worth 30% of revenue. The operations manager proposes buying a lockable cabinet for each desk and considers the issue closed.
1. Map the findings to the relevant ISO/IEC 27002:2022 controls across organizational, people, physical, and technological themes.
Read the worked answer
Organizational: 5.10 acceptable use, 5.12 and 5.13 classification and labelling, 5.14 information transfer, 5.19 to 5.22 supplier and contractor control. People: 6.3 awareness, 6.4 disciplinary process, 6.6 confidentiality agreements, 6.8 event reporting, 5.11 return of assets. Physical: 7.1 perimeters, 7.2 entry, 7.4 monitoring, 7.6 secure areas, 7.7 clear desk and clear screen, 7.9 off-premises assets, 7.10 storage media. Technological: 8.1 endpoint devices, 8.24 cryptography for the USB, 8.12 data leakage prevention. The shared reception and cleaning contractor mean perimeter and supplier controls must be considered together, not as a single cabinet purchase.
2. Evaluate the operations manager's proposal. What would you prioritize and why?
Read the worked answer
The cabinet is a partial 7.7 measure, but it does not fix lost badges, unlocked laptops, shared reception, or removable media. Prioritize: cancel and reissue all badges, reconcile the 14 missing badges, and require contractor badge sign-in and sign-out (7.2, 5.19 to 5.22); enable auto-lock and full-disk encryption on laptops (8.1, 8.24); introduce clean desk and screen checks (7.7); restrict and encrypt USB media (7.10, 8.12); add awareness and event reporting (6.3, 6.8); and require contractor NDAs (6.6). These reduce both likelihood and impact. Evidence should include badge logs, encryption coverage reports, and clear-desk audit results.
3. How should the studio respond to the client's request for evidence without overstating compliance?
Read the worked answer
Provide a control map, the relevant policies, and sample evidence such as badge reconciliation records, encryption coverage, and awareness completion. Be transparent: state which controls are implemented, which are in progress, and the dated remediation plan. Do not claim ISO/IEC 27001 certification unless it exists, and do not describe 27002 as certifiable. Offer compensating controls and management sign-off for gaps. If the client requires assurance, consider an independent review (5.35) or a scope-limited audit. Overstating compliance creates contractual and reputational risk.