Delayed corrective action - what to do

if there is an audit observation that VAPT (penetration testing for servers and software) was not done and corrective action is taken that the VAPT will be conducted in December 2024 but the organization failed to conduct the VAPT due to some internal or budget issues, as a QMS person should I initiate planned deviation and how it will impact the future audit

 

Ok let me give a short brief, i know it is for ISO 9001 but this is as per ISO 27001 (ISMS) it is mandatory to conduct VAPT (Vulnerability Assessment and Penetration Testing) regularly (Annually in this case) this test ensure that all your servers or IP addresses are working as per standard and are secure from any potential cyber threat so a tester try to breach the security to test stability and security of these IPs.
On the basis of this VAPT which organization failed to conduct at the time and certifying body issued a major non-conformity and organization took corrective action that they will conduct this in december 2024 but as per the changes in IT infrastructure it seems that it will not possible to conduct that test again before decemeber 2024 so that what happened.

Now on the basis of above scenario i want your POV that can't we initiate a planned deviation as a proactive approach to save another critical or major observation

 

I think the factors that prevented the conduct of the VAPT as per the annual schedule also prevented the implementation of the rescheduled testing on December 2024. Actually, just rescheduling the test is not a corrective action. Your problem will just keep on persisting unless your organization address the factors preventing the implementation of the VAPT. As a QMS person, you need to have a good understanding of the definition of the term corrective action. Determine the factors mentioned then implement actions to eliminate them.

 

I know but what if organization having budget issues to conduct the VAPT on time how could we solve that then?

 

See i know there is a problem with organization in maintaining QMS or ISMS but my question is that organization issues budget to do these VAPTs but what if the Budget was the reason for that non conformity, so how should we handle that?

 

Simple. Go out back to the money tree and get some.

Assuming this is an important test for your organization it seems you have a few things going on. You’ll obviously need to delay finishing your corrective action. You’ll want to note why the delay is necessary. You’ll also want to explore why this can’t be part of standard operating procedure and not subject to lack of budget. This is likely beyond your pay grade, so you’ll want to kick it up to the powers that be and get their input. Good luck.

 

Thanks andy

 

Thanks, golfman!!!