ISOISO 27001Continual ImprovementEASYFree question
When a nonconformity occurs, ISO/IEC 27001:2022 Clause 10.2 first requires the organization to do which of the following?
- A.Notify the certification body, including a request for guidance on severity, and await its decision on the finding
- B.Review the effectiveness, including a check of the records, and decide whether the audit scope needs change
- C.React to it, including taking action to control and correct it, and deal with the consequences
- D.Identify the cause, including interviews with staff, and update the risk register
Why C is correct
Clause 10.2 a) states the organization shall react to the nonconformity and, as applicable, take action to control and correct it and deal with the consequences. Notification timing and SoA updates are not the first prescribed reaction.
Know someone studying for ISO 27001? Send them this one.