Scenario 7: Yefund, an insurance Company headquartered in Monaco, is a reliable name in Commerce, industry, and Corporate services. With a rich history spanning decades, Yefund has consistently delivered
tailored insurance solutions to businesses of all sizes. safeguarding their assets and mitigating risks. As a forward-thinking company, Yetund recognizes the importance of information security in protecting
sensitive data and maintaining the trust Of Its clients. Thus, has embarked on a transformative journey towards implemenung an ISMS based on ISO/IEC 27001-
iS implementing cutting-edge Al technologies within its ISMS to improve the identification and management Of information assets, Through Al. is automating the identification Of assets. tracking
changes over time. and strategically selecting controls based on asset sensitivity and exposure. This proactive approach ensures that Yefund remains agile and adaptive in safeguarding critical information assets
against emerging threats. Although Yetund recognized the urgent need to enhance its security posture, the implementation team took a gradual approach to integrate each ISMS element- Rather than waiting for
an official launch, they carefully tested and validated security controls, gradually putting each element into operational mode as it was completed and approved. This methodical process ensured that critical
security measures, such as encryption protocols. access controls. and monitoring systems. were fully operational and effective in safeguarding customer information, including personal. policy, and financial
details.
Recently. Kian. a member of Vefund ' s information security team. identified two security events. Upon evaluation. one reported incident did not meet the criteria to be classified as such- However, the second
incident. involving critical network components experiencing downtime. raised concerns about potential risks to sensitive data security and was therefore categorized as an incident. The first event was recorded
as a report without further action, whereas the second incident prompted a series Of actions, including investigation. containment, eradication, recovery. resolution, closure, incident reporting, and post-incident
activities. Additionally. IRTS were established to address the events according to their Categorization.
After the incident. Yetund recognized the development of internal communication protocols as the single need to improve their ISMS framework It determined the relevance of communication aspects such as
what, when, with whom. and how to Communicate effectively Yefund decided to focus On developing internal communication protocols, reasoning that internal coordination their most immediate priority. This
decision was made despite having external stakeholders. such as clients and regulatory bodies. who also required secure and timely communication.
Additionally, Yefund has prioritized the professional development Of its employees through comprehensive training programs, Yefund assessed the effectiveness and impact Of its training initiatives through
Kirkpatrick ' s four-level training evaluation model. From measuring trainees ' involvement and impressions of the training (Level 1) to evaluating learning outcomes (Level 2), post-training behavior (Level 3), and
tangible results (Level 4), Yefund ensures that Its training programs ate holistic. impactful. and aligned With organizational objectives.
Yefund•s journey toward implementing an ISMS reflects a commitment to security, innovation, and continuous improvement, By leveraging technology, fostering a culture Of proactive vigilance, enhancing
communication ptotOCOlS, and investing in employee development. Yefund seeks to fortify its position as a trusted partner in safeguarding the interests Of its Clients and stakeholders.
Did Yefund handle the identified information security events appropriately? Refer to scenario 7.
Scenario 7: Yefund, an insurance Company headquartered in Monaco, is a reliable name in Commerce, industry, and Corporate services. With a rich history spanning decades, Yefund has consistently delivered
tailored insurance solutions to businesses of all sizes. safeguarding their assets and mitigating risks. As a forward-thinking company, Yetund recognizes the importance of information security in protecting
sensitive data and maintaining the trust Of Its clients. Thus, has embarked on a transformative journey towards implemenung an ISMS based on ISO/IEC 27001-
iS implementing cutting-edge Al technologies within its ISMS to improve the identification and management Of information assets, Through Al. is automating the identification Of assets. tracking
changes over time. and strategically selecting controls based on asset sensitivity and exposure. This proactive approach ensures that Yefund remains agile and adaptive in safeguarding critical information assets
against emerging threats. Although Yetund recognized the urgent need to enhance its security posture, the implementation team took a gradual approach to integrate each ISMS element- Rather than waiting for
an official launch, they carefully tested and validated security controls, gradually putting each element into operational mode as it was completed and approved. This methodical process ensured that critical
security measures, such as encryption protocols. access controls. and monitoring systems. were fully operational and effective in safeguarding customer information, including personal. policy, and financial
details.
Recently. Kian. a member of Vefund ' s information security team. identified two security events. Upon evaluation. one reported incident did not meet the criteria to be classified as such- However, the second
incident. involving critical network components experiencing downtime. raised concerns about potential risks to sensitive data security and was therefore categorized as an incident. The first event was recorded
as a report without further action, whereas the second incident prompted a series Of actions, including investigation. containment, eradication, recovery. resolution, closure, incident reporting, and post-incident
activities. Additionally. IRTS were established to address the events according to their Categorization.
After the incident. Yetund recognized the development of internal communication protocols as the single need to improve their ISMS framework It determined the relevance of communication aspects such as
what, when, with whom. and how to Communicate effectively Yefund decided to focus On developing internal communication protocols, reasoning that internal coordination their most immediate priority. This
decision was made despite having external stakeholders. such as clients and regulatory bodies. who also required secure and timely communication.
Additionally, Yefund has prioritized the professional development Of its employees through comprehensive training programs, Yefund assessed the effectiveness and impact Of its training initiatives through
Kirkpatrick ' s four-level training evaluation model. From measuring trainees ' involvement and impressions of the training (Level 1) to evaluating learning outcomes (Level 2), post-training behavior (Level 3), and
tangible results (Level 4), Yefund ensures that Its training programs ate holistic. impactful. and aligned With organizational objectives.
Yefund•s journey toward implementing an ISMS reflects a commitment to security, innovation, and continuous improvement, By leveraging technology, fostering a culture Of proactive vigilance, enhancing
communication ptotOCOlS, and investing in employee development. Yefund seeks to fortify its position as a trusted partner in safeguarding the interests Of its Clients and stakeholders.
According to scenario 7, did Yefund correctly define Level 2 of Kirkpatrick’s four-level training evaluation model?
How is an " information need ' typically defined in the context of ISMS monitoring?
Scenario 10: ProEBank
ProEBank is an Austrian financial institution known for its comprehensive range of banking services. Headquartered in Vienna, it leaverages the city ' s advanced technological and financial ecosystem To enhance its security posture, ProEBank has implementied an information security management system (ISMS) based on the ISO/IEC 27001. After a year of having the ISMS in place, the company decided to apply for a certification audit to obtain certification against ISO/IEC 27001.
To prepare for the audit, the company first informed its employees for the audit and organized training sessions to prepare them. It also prepared documented information in advance, so that the documents would be ready when external auditors asked to review them Additionally, it determined which of its employees have the knowledge to help the external auditors understand and evaluate the processes.
During the planning phase for the audit, ProEBank reviewed the list of assigned auditors provided by the certification body. Upon reviewing the list, ProEBank identified a potential conflict of interest with one of the auditors, who had previously worked for ProEBank ' s mein competitor in the banking industry To ensure the integrity of the audit process. ProEBank refused to undergo the audit until a completely new audit team was assigned. In response, the certification body acknowledged the conflict of interest and made the necessary adjustments to ensure the impartiality of the audit team
After the resolution of this issue, the audit team assessed whether the ISMS met both the standard ' s requirements and the company ' s objectives. During this process, the audit team focused on reviewing documented information.
Three weeks later, the team conducted an on-site visit to the auditee’s location where they aimed to evaluate whether the ISMS conformed to the requirements of ISO/IEC 27001. was effectively implemented, and enabled the auditee to reach its information security objectives. After the on-site visit the team prepared the audit conclusions and notified the auditee that some minor nonconformities had been detected The audit team leader then issued a recommendation for certification.
After receiving the recommendation from the audit team leader, the certification body established a committee to make the decision for certification. The committee included one member from the audit team and two other experts working for the certification body.
After the Stage 2 audit, minor nonconformities were found. Despite this, the audit team leader issued a positive recommendation for certification.
Question:
Is this acceptable?
Is NyvMarketing required to follow the guidelines of ISO/IEC 27002 to attain ISO/IEC 27001 certification?
Diana works as a customer service representative for a large e-commerce company. One day, she accidently modified the order details of a customer without their permission Due to this error, the customer received an incorrect product. Which information security principle was breached in this case7
BioLooVitalis is a biopharmaceutical firm headquartered in Singapore Renowned for its pioneering work in the fie d of human therapeutics. BioLooVitalis places a strong emphasis on addressing critical healthcare concerns particularly in the domains of cardiovascular diseases, oncology bone health, and inflammation BioLooVitalis has demonstrated its commitment to data security and integrity by maintaining an effective information security management system (ISMS) based on ISO/IEC 77001 for the past two years. After noticing an increase m failed login attempts over several weeks. bioLooVitalis IT security learn reviewed log data, correlated it with user behavior patterns, and mapped it against known attach vectors to determine potential causes. Based on their findings, they prepared a technical report detailing the nature of the anomalies and submitted it to the compliance function. The compliance team then summarized the findings and presented them to the executive management during the quarterly ISMS performance review. To proactively track system behavior following the spike n failed login attempts. BioLooVitalis ' s IT security team configured a dashboard showing real time login activity. system response times, and end point availability across departments. This helped the team quickly detect abnormal behavior without waiting formal reporting cycles. Following The implementation of the real time access control dashboard BioLooVitalis internal audit team assessed whether the new processes and tools effectively reduced unauthorized access attempts and met both technical and policy-based requirements. Lastly, the internal auditors collected system-generated access logs, reviewed user access reports, and conducted interviews with IT personnel. These data sources helped them verify whether the new controls were functioning as intended and aligned with internal ISMS objectives. Based on The scenario above, answer the following question.
According to scenario 8 what did the internal auditors collect during the evaluation of the new access control measures?
A healthcare organization needs to ensure that patient records are available to the medical staff whenever needed. Which measure should it prioritize to achieve this?
Has Bytes determined all the relevant factors that impact its ability to achieve the intended outcomes of its ISMS, in accordance with clause 4.1 " Understanding the organization and its context " of ISO/IEC 27001?
A manufacturing company faced a risk of production delays due to potential supply chain disruptions. After assessing the potential impact of the risk, the company decided to accept the risk, considering the disruption unlikely to significantly affect its operations. Which risk treatment option did the company select in this case?
TESTED 04 May 2026
