ISOISO 27001Performance EvaluationEASYFree question
Clause 9.2.1 states that the organization shall conduct internal audits at planned intervals. The primary information these audits must provide is whether the ISMS does what?
- A.Generates the highest possible revenue for the organization
- B.Uses only software products from a single approved vendor
- C.Eliminates the need for any external certification audit
- D.Conforms to the organization's own requirements and to ISO/IEC 27001, and is effectively implemented and maintained
Why D is correct
Internal audits determine whether the ISMS conforms to the organization's own requirements and the requirements of the standard, and whether it is effectively implemented and maintained. Revenue, vendor choice, and certification are not the focus of Clause 9.2 audits.
Know someone studying for ISO 27001? Send them this one.