ISOISO 27001Continual ImprovementEASYFree question
When a nonconformity occurs, ISO/IEC 27001:2022 Clause 10.2 first requires the organization to do which of the following?
- A.Immediately revoke its certificate of conformity
- B.Update the Statement of Applicability before any other step
- C.React to it, including taking action to control and correct it, and deal with the consequences
- D.Notify the certification body within 24 hours
Why C is correct
Clause 10.2 a) states the organization shall react to the nonconformity and, as applicable, take action to control and correct it and deal with the consequences. Notification timing and SoA updates are not the first prescribed reaction.
Know someone studying for ISO 27001? Send them this one.