PECB ISO-IEC-27001-Lead-Implementer Exam With Confidence Using Practice Dumps

According to ISO/IEC 27001:2022, clause 10.1, an action plan for nonconformities and corrective actions should include the following elements1:

What needs to be done

Who is responsible for doing it

When it will be completed

How the effectiveness of the actions will be evaluated

How the results of the actions will be documented

In scenario 9, the action plan only describes what needs to be done and who is responsible for doing it, but it does not specify when it will be completed, how the effectiveness of the actions will be evaluated, and how the results of the actions will be documented. Therefore, the action plan is not sufficient to eliminate the detected nonconformities.

1: ISO/IEC 27001:2022, Information technology — Security techniques — Information security management systems — Requirements, clause 10.1, Nonconformity and corrective action.

ISO/IEC 27001:2022 is the certifiable standard for Information Security Management Systems (ISMS). While ISO/IEC 27002 provides guidelines and best practices to help organizations implement the controls listed in Annex A of ISO/IEC 27001, it is not mandatory to follow ISO/IEC 27002 to achieve ISO/IEC 27001 certification. Instead, organizations must select and implement appropriate controls from Annex A, or other controls as necessary, based on their risk assessment. ISO/IEC 27002 serves as guidance but is not itself an auditable or certifiable requirement.

"The controls listed in Annex A are not exhaustive and additional controls may be needed. ISO/IEC 27002 provides implementation guidance and is not mandatory for certification against ISO/IEC 27001."

— ISO/IEC 27001:2022, Introduction and Clause 6.1.3; ISO/IEC 27002:2022, Foreword