Section 10 addresses how you will improve your ISMS on an ongoing basis.
ISO 27001, like many other ISO standards, is concerned with continual improvement. Given the speed of change in many organisations, not to mention the ever-changing threat landscape, this is arguably one of the most important areas of the standard.
Falling under Sect.10 is:
Section 10.1 of ISO 27001 concerns the actions your organisation commits to taking when a failure in the compliance of the standard occurs. The standard refers to this as a ‘nonconformity’ and the steps you take to correct this is called a ‘corrective action’.
In the event of a nonconformity, the organisation should ‘take action to control and correct it’, and deal with the consequences of the event. They should then take steps to ensure that it doesn’t happen again. This is done by addressing the cause of the nonconformity.
The corrective action should be assessed and the effectiveness of that action, measured and documented. Remember, to obtain and maintain ISO 27001 certification, an auditor will expect to see evidence of improvements.
It is not a failure to show you are addressing nonconformities, taking corrective actions etc so do make sure that they are visible if appropriate to demonstrate the philosophy of continuous improvement that is required by the standard.
Using ISMS.online software to manage your ISMS will give you access to not just a policy for 10.1, but also the Corrective Actions & Improvement Track which has been built for you to quickly and simply demonstrate and evidence the work being done.
It is customised ready to use immediately and will help you manage the corrective actions and improvements you identify through a standard workflow process. You will be able to assign actions to team members, set due dates, and join-up your ISMS by linking it quickly to other areas, such as a policy or control which may need updating.
A large part of running an information security management system is to see it as a living and breathing thing. Your organisation should always be assessing, testing, reviewing and measuring the performance of the ISMS, to ensure it is still supporting and meeting your business goals.
There are several mechanisms covered within ISO 27001 for the continual evaluation and improvement of your ISMS including audits, management reviews, the corrective actions and improvements process, ongoing risk assessment, ongoing staff engagement etc. The secret is not to waste time duplicating work that is going on in the wider ISMS in order to easily demonstrate continual improvement is taking place.
This is a great example of how the ISMS.online solution brings everything together so there is no need to duplicate effort. Simply reiterate the work that is going on in the wider system, joining it up holistically and through the powerful linking feature.
Again, ISMS.online comes with a Policy for 10.2 which already includes links to the areas where you will be able to quickly demonstrate continual improvement is embedded in your organisation.
Expert guidance on meeting the requirements of Sect 10. is included in our optional ISO 27001 Virtual Coach.
A tailored hands-on session based on your needs and goals
Easily collaborate, create and show you are on top of your documentation at all times
Find out more
Effortlessly address threats & opportunities and dynamically report on performance
Find out more
Make better decisions and show you are in control with dashboards, KPIs and related reporting
Find out more
Make light work of corrective actions, improvements, audits and management reviews
Find out more
Shine a light on critical relationships and elegantly link areas such as assets, risks, controls and suppliers
Find out more
Select assets from the Asset Bank and create your Asset Inventory with ease
Find out more
Out of the box integrations with your other key business systems to simplify your compliance
Find out more
Neatly add in other areas of compliance affecting your organisation to achieve even more
Find out more
Engage staff, suppliers and others with dynamic end-to-end compliance at all times
Find out more
Manage due diligence, contracts, contacts and relationships over their lifecycle
Find out more
Visually map and manage interested parties to ensure their needs are clearly addressed
Find out more
Strong privacy by design and security controls to match your needs & expectations
Find out more