How does organizational culture affect continual improvement?
- A.Culture matters at management level alone, and the reporting habits of staff have little bearing on improvement provided the policies are signed and communicated
- B.Culture has no direct effect on improvement, and clause 10 relies on the corrective-action procedure to surface issues regardless of whether staff report them
- C.Culture falls outside ISO 27001 entirely, and the standard measures improvement through audit findings, control counts, and the closure rate of corrective actions
- D.A culture that encourages reporting issues, learning from mistakes, and sharing ideas significantly enhances improvement efforts
Why D is correct
A positive security culture that encourages open reporting, learning from mistakes, and sharing improvement ideas significantly enhances continual improvement.
Know someone studying for ISO 27001? Send them this one.