ISOISO 27001Continual ImprovementEASYFree question
An auditor asks an organization to demonstrate compliance with ISO/IEC 27001:2022 Clause 10.1. Which ongoing outcome must the organization show it is pursuing?
- A.Continually reducing the cost, headcount and audit effort required to operate the ISMS
- B.Continually auditing the scope, objectives and controls of the ISMS
- C.Continually improving the suitability, adequacy and effectiveness of the ISMS
- D.Continually certifying the policies, procedures and records of the ISMS
Why C is correct
Clause 10.1 requires the organization to continually improve the suitability, adequacy and effectiveness of the ISMS. It does not demand elimination of all risk or zero incidents, which are unrealistic absolutes.
Know someone studying for ISO 27001? Send them this one.