ISOISO 27001Continual ImprovementEASYFree question
An auditor distinguishes a correction from a corrective action using a server-room overheating incident. Which pairing correctly maps each term to the action?
- A.Correction: power down affected servers to stop damage; Corrective action: install temperature monitoring and an alerting threshold to prevent overheating recurrence
- B.Correction and corrective action are the same in this case
- C.Correction: notify the certification body; Corrective action: update the asset register
- D.Correction: install temperature monitoring; Corrective action: power down the servers
Why A is correct
Correction addresses the immediate situation (powering down to halt damage). Corrective action eliminates the cause so the nonconformity does not recur (monitoring and alerting that catch rising temperatures early). The two are distinct steps in Clause 10.2.
Know someone studying for ISO 27001? Send them this one.