ISOISO 27001Management ReviewEASYFree question
How should information security objectives be addressed in management review?
- A.Management should delegate objective tracking to the internal auditor and approve any change to the audit programme at the next surveillance
- B.Management should compare objectives with the certification body targets and adopt the registrar's wording for the next cycle
- C.Management should approve the objectives and file them in the document register
- D.Management should review progress toward achieving objectives and decide whether objectives need to be updated
Why D is correct
Management review should evaluate progress toward security objectives and determine if objectives need updating based on changing circumstances.
Know someone studying for ISO 27001? Send them this one.