ISOISO 27001Implementation and OperationEASYFree question
Clause 8.1 distinguishes between planned changes and unintended changes. How does the standard require each to be treated during operation?
- A.Planned changes are approved by the certification body in advance, while unintended changes are reported to the regulator and logged in the incident register
- B.Planned changes are tested in a sandbox first, while unintended changes are reversed immediately and excluded from the ISMS scope statement
- C.Planned changes are announced to customers in advance, while unintended changes are handled by the supplier and recorded in the contract file
- D.Planned changes are controlled in advance, while unintended changes have their consequences reviewed and adverse effects mitigated
Why D is correct
Clause 8.1 requires planned changes to be controlled and the consequences of unintended changes to be reviewed, with action taken to mitigate adverse effects as necessary. The two categories are handled differently but both demand attention.
Know someone studying for ISO 27001? Send them this one.