Continual Improvement
Definition
The ISO/IEC 27001 requirement (clause 10) that the organisation must actively improve the suitability, adequacy, and effectiveness of the ISMS over time. Demonstrated through corrective action records, nonconformity logs, and evidence that identified weaknesses have been addressed.
- Field
- ISMS design under ISO/IEC 27001
- Standard clause
- Clause 10
- Requirement
- Actively improve ISMS suitability, adequacy, effectiveness
- Evidence used
- Corrective action records, nonconformity logs
Common questions
How does an auditor verify continual improvement rather than just a static ISMS document?+
Auditors look for a trail of evidence over time: logged nonconformities from internal audits or incidents, documented corrective actions taken in response, and follow-up records confirming those actions actually reduced or eliminated the identified weakness, rather than a policy document that reads well but shows no history of change.
What distinguishes continual improvement from simply fixing individual incidents as they occur?+
Fixing an individual incident addresses one instance, while continual improvement under Clause 10 requires the organisation to analyse root causes, adjust the ISMS itself so similar nonconformities are less likely to recur, and track that adjustment's effectiveness over subsequent review cycles.
Related terms
- Annex a
- The normative annex to ISO/IEC 27001 that lists 93 information security controls across four themes: organisational (37 controls), people (8), physical (14),...
- ISMS Scope
- The explicit boundaries of the management system: which organisational units, sites, processes, and information assets are covered. Defined under ISO/IEC 27001 clause...
- Management Review
- The annual governance meeting required under ISO 17025 Clause 8.9, at which laboratory management reviews the aggregated quality performance data (PT results,...
- Risk Treatment Plan
- A document that records, for each identified risk, the chosen treatment option (accept, avoid, transfer, or reduce), the specific controls selected to...
- Statement of Applicability (SoA)
- A mandatory document listing every ISO/IEC 27001 Annex A control with a statement of whether it is included or excluded, the justification...