ISOISO 27001Performance EvaluationEASYFree question
An auditor reviewing 9.1 evidence finds dashboards on screen but no retained records of past measurement results. Which requirement is at risk?
- A.There is no documented-information requirement attached to clause 9.1
- B.The organization shall retain appropriate documented information as evidence of the monitoring and measurement results
- C.Only the methods, not the results, must be retained
- D.Records are required only if a nonconformity has occurred
Why B is correct
Clause 9.1 requires retention of appropriate documented information as evidence of the results. Live dashboards that overwrite history do not by themselves demonstrate past results, so retained records are needed.
Know someone studying for ISO 27001? Send them this one.