ISOISO 27001Continuous ImprovementEASYFree question
How do information security objectives relate to continual improvement?
- A.Objectives exist for the compliance record, since clause 6.2 treats them like a documented statement and expects no progress tracking
- B.Objectives should be regularly reviewed and updated, with progress tracked as part of the improvement cycle
- C.Objectives are fixed at certification, because a change would invalidate the certificate and the SoA
- D.Objectives stay unchanged between audits, so progress is measured once and reported to the auditor
Why B is correct
Security objectives should be regularly reviewed and updated, with progress toward achieving them tracked as a key measure of ISMS improvement.
Know someone studying for ISO 27001? Send them this one.