ISOISO 27001Performance EvaluationEASYFree question
An auditor reviewing 9.1 evidence finds dashboards on screen but no retained records of past measurement results. Which requirement is at risk?
- A.The organization shall file the dashboards in the audit report and send them to the certification body as proof of the review results
- B.The organization shall publish the dashboard screens to the staff and keep the live view as the record of the measurement process
- C.The organization shall appoint a record keeper and hold the dashboards as proof of results
- D.The organization shall retain appropriate documented information as evidence of the monitoring and measurement results
Why D is correct
Clause 9.1 requires retention of appropriate documented information as evidence of the results. Live dashboards that overwrite history do not by themselves demonstrate past results, so retained records are needed.
Know someone studying for ISO 27001? Send them this one.