ISOISO 27001Continual ImprovementEASYFree question
An auditor finds that one branch office stored decommissioned drives without sanitizing them, breaching the media disposal procedure. After correcting that branch, Clause 10.2(c) prompts a specific evaluation. Which action does it require?
- A.Immediately schedule a recertification audit for all offices
- B.Determine whether the same unsanitized-disposal nonconformity exists or could occur at the organization's other offices
- C.Replace the media disposal procedure with a stricter international standard
- D.Suspend disposal activities organization-wide until further notice
Why B is correct
Clause 10.2(b)2 requires determining whether similar nonconformities exist or could potentially occur elsewhere. Here that means checking the other offices for the same unsanitized-disposal weakness.
Know someone studying for ISO 27001? Send them this one.