10. Improvement

10.1 Continual improvement

The ISMS improves through the cycle on these pages: we plan (risks and objectives), do (treatment and policies), check (ISMS security meetings, internal audit, management review) and act (corrective actions and new objectives).

10.2 Nonconformity and corrective action

A non-conformity is any requirement of the standard or of our own policies that is not met. It can come from an audit, an incident, a missed recurring task, or anyone who notices it.

1. Record it as an issue linked to the ISMS non-conformities register, using the template there.
2. React: control and correct it, and deal with the consequences.
3. Find the root cause. Keep asking why until the cause is something we can change. A stolen laptop that was left in a car is not caused by the car: the question is why the employee did not know better, and what makes the rule stick.
4. Check whether the same cause exists elsewhere.
5. Take the corrective action, with an owner and a due date, and update the ISMS if needed.
6. Verify that the action worked and record how in the issue before closing it.