ISOISO 27001Continual ImprovementEASYFree question
A monitoring dashboard shows patch-compliance dropped below the organization's defined 95% threshold for three consecutive weeks. The team treats this trend as a nonconformity input. Which source category does this represent?
- A.Internal audit findings, which are a source for nonconformities and observations in the programme
- B.Customer complaints, which the sales team logs and the helpdesk reviews against the contract terms in the CRM
- C.Monitoring and measurement results, which are a legitimate source for detecting nonconformities against defined criteria
- D.Supplier audit reports, which the procurement team collects and archives each year
Why C is correct
Performance monitoring and measurement (Clause 9.1) is a key source of nonconformity detection. When measured results fall below defined criteria such as a patch-compliance threshold, that deviation is a nonconformity that should enter the Clause 10.2 process.
Know someone studying for ISO 27001? Send them this one.