Key takeaways
- Keep improving the suitability, adequacy and effectiveness of the ISMS.
- The ISMS should get better over time, not just stay compliant.
- Start here: collect improvement ideas from audits, incidents, metrics and staff.
Purpose
Keep improving the suitability, adequacy and effectiveness of the ISMS.
Requirement
Requirement summaryThe organization shall continually improve the suitability, adequacy and effectiveness of the information security management system.
Why it matters
The ISMS should get better over time, not just stay compliant.
How to implement
- Collect improvement ideas from audits, incidents, metrics and staff.
- Prioritise and implement improvements.
- Track them in an improvement log.
- Review progress at management review.
What evidence you need to provide
Here is what you will typically need to provide for Clause 10.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your approach to continual improvement.
Records and examples to show
- Examples of improvements made, such as updated controls or processes.
- Records showing improvement ideas from reviews were decided on.
Things you should be able to show or explain
- Be able to explain one or two recent improvements.
How much to show: A handful of improvements.
Common mistakes
- Nothing improved in a year.
- Ideas collected but never acted on.
- No evidence of any improvement between audits.
- Improvement ideas lost.
- Tip: Nonconformities aren't failures — they're proof your ISMS is learning.
Policies & documents to have
- Corrective action and continual improvement procedure
FAQ
Can we exclude clause 10.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Evidence of improvements over time.