ISOISO 27001Performance EvaluationEASYFree question
Clause 9.1 requires that the organization retain documented information as evidence of the monitoring and measurement results. What is the principal reason this evidence must be kept?
- A.To satisfy the certification body that a policy exists and to support the renewal of the certificate each year
- B.To prove the audit was scheduled and the auditors were independent
- C.To support the risk register and justify the budget for the next cycle
- D.To demonstrate the results actually occurred and support evaluation of performance
Why D is correct
Documented information serves as objective evidence that monitoring and measurement results were produced and that information security performance and ISMS effectiveness were evaluated. It does not substitute for audits or management reviews, nor is it a marketing artifact.
Know someone studying for ISO 27001? Send them this one.