ISOISO 27001Management ReviewEASYFree question
Should the ISMS scope be reviewed during management review?
- A.No, the scope is fixed at certification, and any change must wait for the recertification audit before management considers it
- B.No, scope belongs to the lead auditor, and management reviews the policy wording
- C.Yes, the adequacy of the ISMS scope should be reviewed considering changes in context and interested party requirements
- D.Yes, the scope is reviewed by the certification body, and management receives the outcome in the audit report
Why C is correct
The ISMS scope should be reviewed during management review to ensure it remains appropriate given changes in organizational context and requirements.
Know someone studying for ISO 27001? Send them this one.