Control 10.1Continual improvement
Continually improve the suitability, adequacy and effectiveness of the information security management system.
In the 2022 edition this clause comes first in clause 10, ahead of nonconformity and corrective action, and the order is deliberate: improvement is not merely the correction of things found to be wrong.
Corrective action is reactive by definition — something failed, and the system responds. Continual improvement includes the changes an organisation makes because it can see a better way, because the threat landscape moved, or because a control that works today will not scale. An ISMS whose only improvements are closed nonconformities is a system that improves exactly as fast as it fails.
The evidence is usually found in the management review outputs under 9.3.3 and in the objectives under 6.2. Where those record only remediation, this clause is being met by accident rather than by intent, and an auditor is entitled to ask what improvement was planned rather than prompted.
How to put this in place
The ISMS should improve over time rather than stand still. A project builds the habit by collecting and acting on opportunities.
- Collect improvement ideas from audits, incidents, measures, feedback and reviews.
- Decide which to take up and which to decline, with reasons.
- Assign owners and dates.
- Carry the changes out through change control.
- Record results and check they helped.
Evidence an auditor usually looks for: a log of improvements considered, decisions, completed changes and their results.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Management Review Meeting PackWord
The decisions to record include each improvement opportunity taken up, with an owner and a date, or declined, with the reason.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.