Exam CISSP topic 1 question 216 discussion

WTF is a nonconformity? Why do they have to use these words

C. Improvement Stage During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are reviewed, assessed, and corrected during the C. Improvement stage. This is evident from the ISO 27001 standard, which requires management reviews to be conducted to ensure the ISMS and its objectives remain suitable, adequate, and effective.

According to ISO-27001, the Improvement stage involves identifying areas for improvement, implementing corrective actions, and continually monitoring and reviewing the ISMS to ensure it remains effective and meets changing organizational needs and objectives.

During an internal audit of an organizational Information Security Management System (ISMS), nonconformities are reviewed, assessed and/or corrected by the organization in the Improvement stage. (Option C)

The answer is C. Improvement. According to the ISO/IEC 27001 standard, which is a widely recognized international standard for information security management systems, the improvement stage is where nonconformities are reviewed, assessed, and corrected by the organization. The purpose of this stage is to identify opportunities for improving the ISMS, including addressing any identified nonconformities. This is an ongoing process that helps the organization continuously improve its information security posture. Planning Implementation Operation Review Improvement

Corrective action in operations is wrong. The process of correcting errors and taking corrective action can lead to new opportunities for improvement. The situation should be dealt with accordingly. It is necessary to retain sufficient documentation to demonstrate that the organization has dealt with the nonconformity appropriately and that the consequences have been addressed. Reference: https://www.solutions-inc.co.uk/iso-27001-clause-10-1-nonconformity-and-corrective-action/

C https://www.isms.online/iso-27001/10-1-nonconformity-and-corrective-action/ The corrective action that follows from a nonconformity is also a key part of the ISMS improvement process that needs to be evidenced along with any other consequences caused by the nonconformity.

ISO 27001 Clause 10.1 Non conformity and corrective action, Clause 10 containing sections 10.1 and 10.2 covers the “Act” part W. Edwards Deming’s Plan-Do-Check-Act (PDCA) cycle. This clause helps an organisation react to nonconformities, evaluate them and take corrective actions with the end goal of continually improving how it runs its daily activities. https://info-savvy.com/iso-27001-clause-10-1-non-conformity-and-corrective-action/