ISOISO 27001Implementation and OperationEASYFree question
An organization's operations team must coordinate with the people, processes, and communications established under Clause 7 to run the ISMS. Which scenario best shows all three Clause 7 elements supporting a single Clause 8 operation?
- A.Certified auditors review the patch process, managers sign the patch window in the policy, and the schedule is published to the certification body
- B.Competent analysts run the patch process, staff are aware of the patch window, and the change is communicated to affected business units
- C.Trained suppliers run the patch process, the board approves the patch window by vote, and the minutes are sent to the regulator after each cycle
- D.Analysts file the patch tickets, staff read the change policy, and the manager emails the vendor
Why B is correct
Clause 8 operation draws on Clause 7.2 competence, 7.3 awareness, and 7.4 communication. Competent analysts performing the patch process, aware staff observing the window, and communicated changes to business units illustrate all three supporting one operational process.
Know someone studying for ISO 27001? Send them this one.