ISOISO 27001Continual ImprovementEASYFree question
Which set of inputs are recognized sources that can trigger continual improvement of the ISMS?
- A.Only external certification audits
- B.Only the annual budget cycle
- C.Audit findings, security incidents, performance metrics, and management review outputs
- D.Only customer complaints submitted in writing
Why C is correct
Improvement is driven from many sources including internal and external audit findings, incidents, monitoring and measurement (KPIs), and management review outputs. Limiting it to a single source would miss most improvement opportunities.
Know someone studying for ISO 27001? Send them this one.