An auditor finds that one branch office stored decommissioned drives without sanitizing them, breaching the media disposal procedure. After correcting that branch, Clause 10.2(b) prompts a specific evaluation. Which action does it require?
- A.Replace the media disposal procedure with a stricter international standard. This activity belongs to the Plan phase, separate from the Check phase.
- B.Immediately schedule a recertification audit for all offices
- C.Suspend disposal activities organization-wide until further notice
- D.Determine whether the same unsanitized-disposal nonconformity exists or could occur at the organization's other offices
Why D is correct
Clause 10.2 b)3 requires determining whether similar nonconformities exist or could potentially occur elsewhere. Here that means checking the other offices for the same unsanitized-disposal weakness.
Know someone studying for ISO 27001? Send them this one.