Continual improvement

Current external reference: ISO/IEC 27001:2022

This is the 2022 clause a 2026 audit may use. It is not the 2020 layer and it is not the DIS text.

The organization has to keep making its ISMS more suitable, more adequate and more effective.

How the 2020 guidance taught the audit

Auditors confirm that the organization runs a regular set of activities to make the ISMS measurably more suitable, adequate and effective, and that continual improvement is pursued through changes to the design and implementation of the ISMS that strengthen its ability to meet requirements, objectives and policy commitments. They confirm improvement is driven through, among other things, actions on risks and opportunities, setting objectives, improving operational controls in the light of new technology, methods and information, analysing and evaluating performance, internal audit, management review and corrective action, and that improvement opportunities are linked to the actions on risks and opportunities, objective planning and operational planning and control. Evidence includes nonconformity and corrective action reports, monitoring and audit results, management review results, interested party security requirements, and the assessment of and decisions on information security events and incidents.

The DIS layer: the 2022 alignment

The DIS body and its annex numbering are not public. This is our reading of the public foreword and the 2022 clause record; where the public record is silent, the page says so.

The 2022 edition moved continual improvement to 10.1 and nonconformity to 10.2. The 2020 audit row was numbered A.7.2 against the 2013 10.2. The number and the title both move.

Evidence an auditor asks for

• ImprovementImprovement register or plan with completed and open improvements
• ImprovementEvidence of measurable improvement in ISMS performance over time
• ImprovementManagement review decisions on improvement
• ImprovementIncident assessment records and decisions that led to improvement

The questions an auditor will ask

Ask what improved in the ISMS in the last cycle, what evidence shows the improvement and how it was decided.

Common gaps

• Improvement limited to closing audit findings
• No measurable change in ISMS performance between review cycles
• Lessons from incidents not turned into ISMS changes

Prepare before the next audit

Correct every reference to 10.1 and 10.2 in the audit procedure and the work papers. Record one improvement with its evidence.

Cross-references