Certbie
Question 1 of 30
\"Innovatia Systems,\" a mid-sized software development company, has implemented both ISO 9001:2015 and ISO 27002:2022 standards. However, during a recent internal audit, it was discovered that the risk management processes for the Quality Management System (QMS) and the Information Security Management System (ISMS) operate independently. The QMS risk assessments primarily focus on product defects and customer satisfaction, while the ISMS risk assessments concentrate on data breaches and system vulnerabilities. This separation has led to duplicated efforts, conflicting priorities, and potential gaps in addressing risks that impact both quality and information security, such as a supplier with poor security practices affecting software quality. Top management recognizes the need for a more integrated approach. Considering the principles of ISO 27002:2022 and ISO 9001:2015, what is the MOST effective strategy for Innovatia Systems to address this issue and improve the overall effectiveness of their management systems?
Integrate the risk management processes of the QMS and ISMS, creating a unified risk register and aligning risk assessment methodologies to address both quality and information security concerns holistically.
Maintain separate risk registers for the QMS and ISMS, but establish a cross-functional team to review both registers regularly and identify any overlapping risks.
Prioritize the risk management framework of the QMS due to its broader scope and adapt the ISMS risk management processes to align with the QMS framework.
Establish a separate risk management team dedicated solely to the ISMS, ensuring that all information security risks are thoroughly assessed and mitigated independently of the QMS.

Preparing for ISO 27002:2022 – Information Security Controls? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free