PECB
LEAD-AUDITOR · Question #305
Which of the following can be considered a minor nonconformity?
The correct answer is C. The information security policy lacks reference to continual ISMS improvement. A missing reference to continual improvement is a documentation issue, not an immediate security risk, making it a minor nonconformity.
Audit Findings and Nonconformities
Question
Which of the following can be considered a minor nonconformity?
Options
- AEmployees lack training to recognize phishing attempts, increasing malware risks
- BLack of multi-factor authentication leaves accounts vulnerable to unauthorized access
- CThe information security policy lacks reference to continual ISMS improvement
How the community answered
(25 responses)- A8% (2)
- B16% (4)
- C76% (19)
Explanation
A missing reference to continual improvement is a documentation issue, not an immediate security risk, making it a minor nonconformity.
Topics
#minor nonconformity#nonconformity classification#ISMS policy#continual improvement
Community Discussion
No community discussion yet for this question.