Version: 3.0
Valid until: 2025-03-11
Classification: Low
3.0 | Edward Robinson | Additions/changes as part of the annual review. Updated the links for the internal and external audit reports under Administrations. |
anDREa B.V. (hereafter called anDREa) is committed to protecting the security of its business information in the face of incidents and unwanted events and has implemented an Information Security Management System (ISMS) that is compliant with ISO/IEC/27001:2017, the international standard for information security.
The purpose of this document is to describe anDREa’s commitment to continual improvement.
This document will be updated at least annually and when significant change happens.
The objective of this control is:
To ensure that nonconformities are properly handled (10.1).
To ensure continual improvement of the ISMS (10.2).
The scope of this document is described in Clause 4 Context of the organisation.
Availability
required reading for:
all employees and contractors of anDREa.
available for all interested parties as appropriate.
a) react to the nonconformity, and as applicable (1) take action to control and correct it; and (2) deal with the consequences.
b) evaluate the need for action the eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by (1) reviewing the nonconformity; (2) determining the causes of the nonconformity; and (3) determining if similar nonconformities exist, or could potentially occur;
c) implement any action needed;
d) review the effectiveness of any corrective action taken; and
e) make changes to the information security management system, if necessary.
Corrective actions shall be appropriate to the effects of the nonconformities encountered.
The organisation shall retain documented information as evidence of:
f) the nature of the nonconformities and any subsequent actions taken, and
g) the results of any corrective action.”
Tickets regarding nonconformities (authorised personnel only).
Corrective action plans (CAPs) (authorised personnel only).
Internal audit reports and external audit reports (authorised personnel only).