How should feedback from interested parties be addressed in management review?
- A.Feedback from customers, regulators, partners, and other stakeholders relevant to the ISMS should be considered as input
- B.Complaints from the certification body, the accreditation authority, and the audit team should be treated as an optional agenda item
- C.Opinions from shareholders, journalists, competitors, and analysts should be logged by marketing as a separate input outside the ISMS
- D.Requests from interested parties are answered by the legal team, and the replies are filed as correspondence outside the review
Why A is correct
Feedback from all relevant interested parties including customers, regulators, and partners should be considered as input to the management review.
Know someone studying for ISO 27001? Send them this one.