ISOISO 27001Performance EvaluationEASYFree question
Clause 9.2.1 states that the organization shall conduct internal audits at planned intervals. The primary information these audits must provide is whether the ISMS does what?
- A.Meets the certification body's fee schedule and the audit calendar, and is approved by the board each year
- B.Complies with the regulator's guidance and with the CISO's policy, and is reviewed by the board
- C.Satisfies customer contracts and supplier agreements, and is certified by an accredited body
- D.Conforms to the organization's own requirements and to ISO/IEC 27001, and is effectively implemented and maintained
Why D is correct
Internal audits determine whether the ISMS conforms to the organization's own requirements and the requirements of the standard, and whether it is effectively implemented and maintained. Revenue, vendor choice, and certification are not the focus of Clause 9.2 audits.
Know someone studying for ISO 27001? Send them this one.