CloudFort's certification was suspended because it effectively operated beyond its approved certification scope without ensuring that the scope extension was formally assessed and approved, making option A the correct answer. Under ISO/IEC 17021-1, certification applies strictly to the defined and approved scope. Any significant organizational change that affects the ISMS, such as creating a new department with different processes and governance impacts, must be communicated promptly and assessed by the certification body before being considered part of the certified scope.
In this scenario, CloudFort did request a scope extension, which is the correct initial action. However, it failed to provide timely and sufficient updates regarding the impact of the new department on the ISMS. As a result, the certification body could not verify whether the extended scope continued to conform to ISO/IEC 27001 requirements. Operating new activities under the assumption of certification before formal approval constitutes misuse of certification, which justifies suspension.
Option B is incorrect because outsourcing internal audits is explicitly permitted by ISO/IEC 27001, provided independence and competence are ensured. Option C is incorrect because the audit team confirmed that the certified ISMS still fulfilled standard requirements; the issue was scope governance, not ISMS failure.
Therefore, the suspension resulted from scope control and certification governance failures, not from nonconformity with the standard itself.