Certbie
Question 1 of 30
Stellar Solutions, a multinational corporation providing cloud-based data analytics services, recently achieved ISO 27001:2022 certification for its Information Security Management System (ISMS). The initial risk assessment, conducted prior to certification, focused primarily on technical vulnerabilities, such as network security, data encryption, and access controls. Following certification, a data breach involving EU citizens\' personal data occurred, resulting in significant fines under the General Data Protection Regulation (GDPR). An internal audit revealed that while the technical controls were implemented as planned, the risk assessment had not adequately considered the specific legal and regulatory requirements of GDPR, particularly concerning data residency, data subject rights, and breach notification timelines. Furthermore, Stellar Solutions also operates in California, and the risk assessment did not account for the California Consumer Privacy Act (CCPA) requirements.\n\nGiven this scenario and considering the principles of ISO 27001:2022, what is the MOST appropriate immediate action Stellar Solutions should take to address the identified shortcomings in its risk assessment process and ensure ongoing compliance with relevant data privacy laws?
Revise the risk assessment methodology to explicitly incorporate legal and regulatory compliance, including GDPR, CCPA, and other applicable data privacy laws, mapping legal requirements to specific ISMS controls and conducting regular legal reviews.
Implement additional technical controls, such as advanced intrusion detection systems and data loss prevention tools, to further strengthen the existing security infrastructure and prevent future data breaches.
Conduct a thorough review of all existing ISMS documentation to identify and correct any inconsistencies or errors, ensuring that all policies and procedures are aligned with the current operational practices.
Outsource the entire ISMS management to a specialized third-party provider with expertise in data privacy regulations, transferring the responsibility for compliance and risk management.

Preparing for ISO/IEC 27001:2022 - Information Security Management Systems Foundation? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free