ISOISO 27001Implementation and OperationEASYFree question
A company wants to keep operational documentation lean. It asks how to decide how much to keep under Clause 8.1 for a highly complex, high-risk cryptographic key ceremony versus a simple low-risk task. The most standard-aligned answer is:
- A.Keep more for the complex high-risk ceremony, scaling documented information to the degree necessary for confidence the process ran as planned
- B.Keep an identical fixed number of documents for both
- C.Keep nothing for either, since competent staff suffice
- D.Keep documentation only for the simple task
Why A is correct
Clause 8.1 ties documented information to the degree necessary to have confidence processes are carried out as planned. A complex, high-risk key ceremony warrants more detailed records than a trivial task, so documentation should scale with complexity and risk rather than be a fixed quantity.
Know someone studying for ISO 27001? Send them this one.