PECB
ISO-IEC-27001-LEAD-AUDITOR · Question #353
Which of the following can be considered a minor nonconformity?
The correct answer is C. The information security policy lacks reference to continual ISMS improvement. A missing reference to continual improvement is a documentation issue, not an immediate security risk, making it a minor nonconformity.
Audit Findings and Conclusions
Question
Which of the following can be considered a minor nonconformity?
Options
- AEmployees lack training to recognize phishing attempts, increasing malware risks
- BLack of multi-factor authentication leaves accounts vulnerable to unauthorized access
- CThe information security policy lacks reference to continual ISMS improvement
How the community answered
(39 responses)- A10% (4)
- B18% (7)
- C72% (28)
Explanation
A missing reference to continual improvement is a documentation issue, not an immediate security risk, making it a minor nonconformity.
Topics
#minor nonconformity#nonconformity classification#ISMS policy#audit findings
Community Discussion
No community discussion yet for this question.