Continual improvement
Plain-language summary
Keeping the ISMS getting better — more suitable to the organisation, more adequate for its risks, more effective in practice — as a standing habit rather than a reaction to audits.
What the clause is really asking
The 2022 edition moved continual improvement to 10.1, ahead of nonconformity and corrective action — an order that reads naturally: improvement is the goal and corrective action one of its sources. The requirement itself is one line: keep making the ISMS more suitable, more adequate and more effective. Sources of improvement are everywhere in the standard: risk assessment results, metrics trends, audit findings, incidents and near-misses, management review decisions, changes in threat intelligence, staff suggestions, customer and regulator feedback, and the continual-improvement opportunities the review is required to consider. Evidence of improvement is a trail of changes with reasons: a control strengthened after an incident, a metric added after an audit, a process simplified because nobody followed the complicated one, a policy rewritten because staff could not understand it. Organisations with a lean or quality culture already have the muscle; this clause asks them to point it at information security.
What auditors look for
Auditors look for improvement that was not forced by a finding: what have you changed in the ISMS this year because you saw a better way, and what prompted it? They trace improvements to their source (incident, metric, audit, review, suggestion) and to their effect (did the measure move?). They look for the ISMS becoming simpler and more used over time, not longer. An ISMS that is identical to the one certified three years ago, with the same risks, controls, metrics and documents, is not continually improving.
Typical evidence
Improvement register or log with source, change made, owner, date and effect; management-review decisions on improvement opportunities; evidence of changes to controls, processes, documents, metrics and training over time with reasons; trend data showing effect; records of staff suggestions and their disposition.
How to comply — recommendations
Keep one improvement log for the ISMS — many organisations use their quality improvement register and tag entries 'ISMS'. Feed it from five places: every incident review, every audit, every management review, every quarterly metrics review and a standing invitation to staff to report what is hard to comply with. Record the change and come back in three months to record the effect. Pick two or three improvements a quarter and finish them rather than opening twenty. Report the log as the continual improvement input to management review.
Common nonconformities
No evidence of improvement beyond closing audit findings; ISMS unchanged for years; improvement opportunities identified at review but not acted on; lessons from incidents not turned into changes; metrics showing deterioration with no response; no mechanism for staff to raise improvement suggestions.
Related clauses
ISO 27001 9.1, 9.3.2, 9.3.3, 10.2; Annex A 5.27 (learning from information security incidents), 5.35, 5.36; ISO 9001 10.1 (shared improvement register; the 2026 edition's 10.1 is also continual improvement).
Resources for this clause
- ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
- Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
- Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
- Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
- Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
- Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.
Get the free ISO 27001:2022 Gap Analysis Checklist
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.