Clause 10: Improvement

Requirement
The organisation must continually improve the suitability, adequacy, and effectiveness of the ISMS.

How to Implement
Treat improvement as an ongoing discipline rather than a once-a-year event tied only to the management review. Use inputs from internal audits, incident post-mortems, risk assessment results, and staff feedback to identify opportunities, even where nothing has technically gone wrong. For example, if a control is technically compliant but inefficient, that is still a legitimate improvement opportunity under this sub-clause.

Mandatory Documents
There is no explicit “shall be available as documented information” statement tied specifically to 10.1 in ISO/IEC 27001:2022. Instead, improvement activity is evidenced through the mandatory records of other clauses, such as management review decisions, audit results, and corrective actions. Therefore, no stand-alone mandatory document is required for 10.1 itself.

Requirement
When a nonconformity occurs, the organisation must react to it by taking action to control and correct it and dealing with the consequences. It must then evaluate the need for action to eliminate the root cause so it does not recur, by reviewing the nonconformity, determining its causes, and checking whether similar nonconformities exist or could occur elsewhere. After that, it must implement any needed action, review the effectiveness of that corrective action, and make changes to the ISMS if necessary. Corrective actions must be proportionate to the effects of the nonconformities encountered.

How to Implement
When something goes wrong, whether a failed control, an audit finding, or an incident, log it immediately. Take an immediate correction to limit the damage, then dig into the root cause, since the “5 Whys” technique works well for this. Decide whether the same issue could exist elsewhere in the organisation, not just where it was found, and apply corrective action broadly enough to prevent recurrence. Finally, after some time has passed, check whether the fix actually worked; this effectiveness review is often skipped but is explicitly required by the standard.

Mandatory Documents
Yes, this is explicitly mandatory. ISO/IEC 27001:2022 states that “documented information shall be available as evidence of the nature of the nonconformities and any subsequent actions taken, and the results of any corrective action.” You must maintain:

• A Nonconformity and Corrective Action Register (or log), recording what went wrong, what was done about it, and whether the fix worked