ISOISO 27001Implementation and OperationEASYFree question
A bank proposes outsourcing its entire core banking platform to a single cloud provider. Before signing, which Clause 8 activity is most directly required because this is a significant proposed change to how a critical process operates?
- A.Appointing an independent auditor to certify the cloud provider before the contract is signed with the bank
- B.Updating the Statement of Applicability to exclude the core banking platform from the ISMS scope statement
- C.Reissuing the information security policy to the bank board members
- D.Performing an information security risk assessment for the proposed change under Clause 8.2
Why D is correct
Clause 8.2 requires risk assessments when significant changes are proposed or occur. Outsourcing the core banking platform is a significant proposed change, so a risk assessment is required before the decision, feeding the control of the planned change under Clause 8.1.
Know someone studying for ISO 27001? Send them this one.