10.1 Continual improvement
Keep improving the suitability, adequacy and effectiveness of the ISMS.
What auditors look for
Evidence of improvements over time.
Typical evidence
Improvement log, trend data.
Playbook
10.1 Continual ImprovementEvidence you need to provide
- Your approach to continual improvement.
- Examples of improvements made, such as updated controls or processes.
- Records showing improvement ideas from reviews were decided on.
- Be able to explain one or two recent improvements.
Policies & documents
Corrective action and continual improvement procedure
View full guide: 10.1 Continual Improvement
10.2 Nonconformity and corrective action
When something goes wrong, react, find the root cause, fix it, check it worked, and keep records.
What auditors look for
Root cause analysis and verified corrective actions.
Typical evidence
Nonconformity/corrective action register.
Playbook
10.2 Nonconformity and corrective actionEvidence you need to provide
- Your process for dealing with nonconformities (things not done as required) and corrective actions (fixes that stop them happening again).
- A log of nonconformities with the root cause, fix and owner.
- Proof fixes worked.
- Records showing you checked whether the same problem existed elsewhere.
- Be able to walk through one problem from discovery to fix.
Policies & documents
Corrective action and continual improvement procedure
View full guide: 10.2 Nonconformity and corrective action
