ISOISO 27001Performance EvaluationEASYFree question
What must the organization determine regarding monitoring and measurement?
- A.What needs to be monitored and measured, the methods, when it shall be performed, and who shall analyze results
- B.The certification body that will witness the results, the sampling method, the annual calendar, and the budget approved by top management
- C.The audit criteria, the sampling plan, the dates of each review, and who approves the policy
- D.The risk owners, the treatment options, the Annex A controls selected, and the review dates
Why A is correct
Clause 9.1 requires determining what to monitor/measure, the methods, when to perform it, when to analyze results, and who performs the analysis.
Know someone studying for ISO 27001? Send them this one.