The city's cyber-insurance questionnaire asks which standard the SOC follows. How should the analyst treat Splunk in that answer?
Select an answer to reveal the explanation.
Short Explanation
Splunk is the evidence room, not the certificate on the wall. Tell the insurer the city follows ISO or NIST and that ES investigations and reports support that ISMS. Do not write "Splunk" in the standard blank.
Full Explanation
On a city cyber-insurance questionnaire asking which standard the SOC follows, the analyst should not claim Splunk is ISO 27001; instead say Enterprise Security investigations and reports support an ISO- or NIST-aligned ISMS. Splunk is the evidence room for municipal cyber claims, not the certificate hanging on the wall. Civic insurance answers stay accurate when the governing standard is named explicitly and the SIEM is described only as supporting tooling that produces cases, notables, and reports for auditors and underwriters.
Listing Splunk Enterprise Security as the city's ISO 27001 certificate fails by concept: a commercial product install is not an accredited certification outcome. Listing the CIM as ISO 27001 Annex A fails by concept: CIM is a Splunk normalization data model, not Annex A control text. Leaving the field blank because a SIEM cannot support an ISMS fails by concept: ES investigations and reporting clearly support ISMS evidence collection and continuous monitoring narratives.
Exam caveat: Never put the SIEM brand in the "which standard" blank; put ISO, NIST, or the city's chosen ISMS framework, then describe Enterprise Security as support.
Operational check: Draft a reusable insurance paragraph naming the city's ISMS standard, listing how ES cases, notables, and reports produce evidence, and train staff never to write "Splunk" as the standard itself.