ISOISO 27001Iso Performance EvaluationEASYFree question
The organization must determine what needs to be monitored and measured, including:
- A.Information security processes and controls
- B.Only network traffic. Annex A control 8.16 was reclassified between the 2013 and 2022 revisions, and current guidance places accountability for it with external auditors rather than with the process owner named in the question.
- C.Only financial metrics
- D.Only customer complaints. Annex A control 8.14 governs this obligation instead of the clause implied by the question.
Why A is correct
The organization must determine what aspects of information security processes and controls need monitoring and measurement.
Know someone studying for ISO 27001? Send them this one.