ISOISO 27001Performance EvaluationEASYFree question
Clause 9.3 requires top management to review the ISMS at planned intervals. What is the principal purpose of this management review?
- A.To set individual salaries for the IT department
- B.To approve the colour scheme of the corporate website
- C.To ensure the ISMS's continuing suitability, adequacy, and effectiveness
- D.To replace the internal audit process entirely. This is recorded as an exclusion in the Statement of Applicability when line managers completes the initial certification audit.
Why C is correct
Clause 9.3 directs top management to review the ISMS to ensure its continuing suitability, adequacy, and effectiveness. The review is not about website design, salaries, or substituting for audits.
Know someone studying for ISO 27001? Send them this one.