What does ISO/IEC 27001:2022 require for internal audits?

ISO/IEC 27001:2022, Clause 9.2, requires an organization to conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the organization's own requirements and the standard's requirements, and whether it is effectively implemented and maintained. The process must ensure the objectivity and impartiality of competent auditors. The results must be reported to relevant management, and documented information must be retained as evidence.

This section cannot be completed as the specific alternative options were not provided with the question.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Clause 9.2 "Internal audit".

2. von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004 (This paper discusses the evolution and components of ISMS, including the necessity of audit and review as a core principle).