ISOISO 27001Performance EvaluationEASYFree question
Clause 9.3 requires top management to review the ISMS at planned intervals. What is the principal purpose of this management review?
- A.To confirm the audit programme is complete, the certificate scope is correct, and the fees are paid
- B.To verify that internal audits ran on time, controls are tested, and findings are closed
- C.To ensure the ISMS's continuing suitability, adequacy, and effectiveness
- D.To approve the policy, appoint auditors, and set the budget
Why C is correct
Clause 9.3 directs top management to review the ISMS to ensure its continuing suitability, adequacy, and effectiveness. The review is not about website design, salaries, or substituting for audits.
Know someone studying for ISO 27001? Send them this one.