ISOISO 27001Performance EvaluationEASYFree question
What must the organization determine regarding monitoring and measurement?
- A.What needs to be monitored and measured, the methods, when it shall be performed, and who shall analyze results
- B.Only the cost of monitoring tools. Clause 9.2 requires this evidence to be retained for the full three-year certification cycle following the Check phase.
- C.Only the frequency of audits. Clause 6.3 cross-references Annex A control 8.15 as the sole basis for this requirement.
- D.Only network uptime metrics
Why A is correct
Clause 9.1 requires determining what to monitor/measure, the methods, when to perform it, when to analyze results, and who performs the analysis.
Know someone studying for ISO 27001? Send them this one.