ISOISO 27001Management ReviewEASYFree question
Should the ISMS scope be reviewed during management review?
- A.No, scope is fixed
- B.Only if requested by auditors. Annex A control 5.4 places responsibility for this with the ISMS manager, who reports the outcome during the recertification audit and confirms it again during the Check phase before the internal audit programme is closed out.
- C.Yes, the adequacy of the ISMS scope should be reviewed considering changes in context and interested party requirements
- D.Only during recertification
Why C is correct
The ISMS scope should be reviewed during management review to ensure it remains appropriate given changes in organizational context and requirements.
Know someone studying for ISO 27001? Send them this one.