How can an auditor verify conformity to control A.9.2.6 Removal or adjustment of access rights of ISO/IEC 27001 by using analytical evidence?

Prepare for the PECB Certified ISO/IEC 27001 Lead Auditor Exam with our comprehensive quiz. Test your knowledge with multiple-choice questions and detailed explanations. Get exam-ready!

The correct choice revolves around evaluating the practical applications of the controls set forth in ISO/IEC 27001, specifically control A.9.2.6, which addresses the removal or adjustment of access rights when users leave the organization or when their access is no longer required.

By analyzing the results of the access rights removal procedure on a sample of users upon the termination of their contracts, an auditor can gather substantial analytical evidence to assess whether the organization effectively implements this control. This approach allows the auditor to verify that when an employee's contract ends, their access rights are promptly and accurately removed in alignment with established procedures. The focus on a sample of actual user cases offers concrete evidence of adherence to the policy, enabling the auditor to draw conclusions regarding the overall effectiveness of the access control mechanisms in place.

In contrast, other options do not provide the same level of direct verification. Analyzing the removal or adjustment of access rights procedure itself might clarify the policy and protocols but does not confirm their application in real-world scenarios. A simulation test may demonstrate preparedness but doesn't reflect actual compliance as seen through the lens of completed terminations. Finally, merely reviewing user access records neglects the critical aspect of assessing the timely and correct implementation of access rights removal in practice.

Subscribe

Get the latest from Examzify

You can unsubscribe at any time. Read our privacy policy