Continual improvement
The organization has to keep improving how suitable, adequate and effective its ISMS is.
What the requirement asks
The organization has to keep improving how suitable, adequate and effective its ISMS is.
What the guidance adds
Continual improvement is expected to be directed at whether the system stays suitable, adequate and effective. The guidance asks for the source of the improvement, the action, the result and the change to the system. Improvement that is only a project list is not continual.
Status of the guidance. The guidance lens for 10.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep an improvement register or log with sources such as audits, reviews, incidents and metrics with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Continual improvementAn improvement register or log with sources such as audits, reviews, incidents and metrics
- Continual improvementEvidence improvements were implemented and their effect assessed
- Continual improvementTrends showing ISMS performance over time
- Continual improvementManagement review decisions driving improvement
The question an assessor will ask
An assessor will ask for an improvement register or log with sources such as audits, reviews, incidents and metrics. The test for 10.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Improvement is limited to closing audit findings
- No record of improvements over time exists
- The effect of improvements is not assessed
- Improvement opportunities from incidents are not captured
Before the next audit
Before the next audit, test this against one live record: improvement is limited to closing audit findings.