ISOISO 27001Continual ImprovementEASYFree question
A monitoring dashboard shows patch-compliance dropped below the organization's defined 95% threshold for three consecutive weeks. The team treats this trend as a nonconformity input. Which source category does this represent?
- A.A customer complaint, because users may be affected
- B.Monitoring and measurement results, which are a legitimate source for detecting nonconformities against defined criteria
- C.A management review output, because dashboards are reviewed by management
- D.An external audit finding, because dashboards are external evidence
Why B is correct
Performance monitoring and measurement (Clause 9.1) is a key source of nonconformity detection. When measured results fall below defined criteria such as a patch-compliance threshold, that deviation is a nonconformity that should enter the Clause 10.2 process.
Know someone studying for ISO 27001? Send them this one.