Free readiness test
ISO/IEC 27001:2022 Lead Auditor: 40 free scenario questions
Lead ISMS certification audits, evaluate Annex A controls and grade nonconformities with confidence.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
During a stage 1 audit of a fintech payments processor, the scope statement reads: 'Information security for the payments platform operated from the Bengaluru office.' The platform runs entirely on a public cloud tenancy administered by a managed service provider (MSP) in another country, and customer card data is tokenised by a third-party vault. The SoA marks supplier controls 5.19–5.22 as applicable but states that 'cloud infrastructure is the provider's responsibility and excluded from scope.' The CISO explains that the MSP holds its own ISO/IEC 27001 certificate, which management believes makes further evidence unnecessary. Interviews show that the MSP's engineers hold standing administrator access to production, that change approvals for infrastructure are raised in the MSP's ticketing system, and that the processor has never reviewed the MSP certificate's scope. The sales team has already told two banking clients that certification will be granted within six weeks.
What is the MOST appropriate conclusion for the lead auditor to record at stage 1?
- AThe scope is acceptable because a certified MSP provides equivalent assurance for the excluded infrastructure.
- BScope boundaries and interfaces are not adequately defined; resolve this before stage 2.
- CThe organisation should be refused certification because the cloud tenancy is outside India and therefore outside the auditor's jurisdiction.
- DThe scope is acceptable provided the stage 2 team samples the tokenisation vault rather than the MSP.