What strategic decisions might result from management review?
- A.Changes to ISMS policy, scope, objectives, resource allocation, risk treatment priorities, or organizational structure
- B.Changes to the certification body, accreditation scheme, auditor rotation, certificate wording, surveillance frequency, or registrar contract terms
- C.Changes to audit sampling, report templates, certificate numbering, registrar contacts, or visit dates
- D.Changes to Annex A numbering, control themes, attribute tags, or the standard revision date
Why A is correct
Strategic outcomes may include changes to policy, scope, objectives, resource allocation, risk priorities, or organizational structure affecting information security.
Know someone studying for ISO 27001? Send them this one.