Continual improvement in ISO 27001 (clause 10.1): an improvement log that works

An improvement log records the changes you make to get better at information security over time, not just the fixes after something goes wrong. Automating a manual check, simplifying a policy people found confusing, or adding MFA to a system before anyone asked: those are improvements.

Why it matters

Clause 10.1 of ISO/IEC 27001:2022 asks you to continually improve the suitability, adequacy and effectiveness of your ISMS. In plain terms: the system should get better each year, and you should be able to show it.

Improvement is also an input to management review (9.3), and it's different from corrective action (10.2):

• Corrective action fixes a nonconformity: something failed to meet a requirement.
• Improvement makes something better that wasn't failing.

Where improvements come from

• Internal and external audits: observations and opportunities for improvement.
• Incidents and near misses: what would have made it easier.
• Management review decisions.
• Staff suggestions, often the best source. The people doing the work know where it's clumsy.
• Objectives: raising the bar once you meet one.
• Changes in technology, threats, customers or the law.

What an auditor looks for

• Evidence that improvement happens: a log, or improvement actions in management review minutes, with outcomes.
• Improvements from more than one source, not only audit findings.
• Follow-through. Improvements were carried out, not just suggested.
• Year-on-year change. At surveillance and recertification audits, auditors expect the ISMS to have moved on since last time.

Common reasons it fails: nothing recorded beyond nonconformities; the same suggestions recorded year after year and never done; or improvement mentioned in a policy but nowhere else.

Common mistakes, and how to keep it manageable

• Waiting for big projects. Small improvements count, and they add up.
• Mixing them with nonconformities. Keep the two apart so your nonconformity trend stays meaningful.
• No owner. Give each improvement an owner and a date, like any other action.
• Not closing the loop. Note what changed and whether it helped.

How to do it in ClearIMS

1. Open Improvement log and record each improvement: where it came from, what will change, the owner and the date.
2. Track the work as tasks, so owners are emailed when it's due.
3. Record the outcome when it's done.
4. Show it. The improvement log feeds your readiness view and the auditor portal pack, and it's an input to management review.

Related pages

• Nonconformities: for things that failed a requirement.
• Management reviews: where improvement decisions are made.
• Internal audits: a common source of improvements.
• Security objectives: improvements often become objectives.