ISO 27001 Continual Improvement Policy Beginner’s Guide

Time needed: 1 hour and 30 minutes

How to write an ISO 27001 Continual Improvement Policy

1. Write the ISO 27001 Continual Improvement Policy Page

   The contents of the continual improvement Policy should include:
   Document Version Control
   Document Contents Page
   Continual Improvement Policy
   Purpose
   Scope
   Principle
   Audit
   Internal Audits
   External Certification Audits
   Client and Third-Party Audits
   Incidents
   Change Management
   Management Review Team
   Review of Objectives
   Legal, Regulatory and Information Security Standards Change
   Improvement as a result of Non-Conformity
   Management of Improvement
   Policy Compliance
   Compliance Measurement
   Exceptions
   Non-Compliance
   Continual Improvement
   Areas of the ISO27001 Standard Addressed

2. Write the ISO 27001 Continual Improvement Policy Purpose

   Record the purpose of the policy. An example of the purpose is – the continual improvement of the suitability, adequacy, and effectiveness of the information security policy and information security management system.

3. Write the ISO 27001 Continual Improvement Policy Scope

   Scope is all employees and third party users and also the information security management system (ISMS).

4. Write the ISO 27001 Continual Improvement Policy Principle

   The principle is the information security management system is continually improved and enhanced through addressing incidents and non-conformities with an effective corrective action and management process.

5. Describe how you perform internal audits

   Internal audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.
   Internal audits are conducted based on risk and business need.
   Internal audits are conducted by individuals independent of the area being audited.
   Internal audits are planned for the year.
   Internal audit results are reported to and overseen by the Management Review Team.
   Internal audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

6. Describe how you perform external audits

   External certification audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.
   External certification audits are conducted based on the certification body requirements.
   External certification audits are planned for the year.
   External certification audits results are reported to and overseen by the Management Review Team.
   External certification audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

7. Describe how you perform client and third party audits audits

   Client and third-party audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.
   Client and third-party audits are conducted based on agreement and subject to a contract and / or non-disclosure agreement being in place.
   Client and third-party audits results are reported to and overseen by the Management Review Team.
   Client and third-party audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

8. Explain the role of information security incidents

   Whilst you will have an incident management process and likely an incident management professional who can help here, our continual improvement policy is going to set out the role incidents play for continual improvement. An example:
   Incident management may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

9. Explain the role of change management

   Change management will consider and may identify an opportunity for improvement.

10. Set out the role of the Management Review Team

    The management review team has an oversight role.
    The management review team as part of the structured management review team agenda consider opportunities for improvement.

11. Document how the review of objectives contributes

    The review of information security objectives will consider and may identify an opportunity for improvement.

12. Explain the role Legal, Regulatory and Information Security Standards Changes

    Changes as a result of legal and regulatory requirements or changes to applicable standards for information security will consider and may identify an opportunity for improvement.

13. Describe Improvement as a result of Non-Conformity

    A non-conformity is a deviation from the norm. This is defined as a deviation from policy and / or process.
    
    Nonconformity to process or policy is identified by the audit process and the occurrence of incidents.
    
    When a nonconformity occurs, action is taken to correct it and deal with the consequences.
    
    Nonconformities are evaluated for the need to eliminate the causes of the non-conformity in order that it does not reoccur or occur elsewhere:
    – Reviewing the non-conformity
    – Determining the cause of the non-conformity
    – Determining if similar nonconformities exist or could potentially occur.
    
    Nonconformities are reported through the Management Review Team.
    
    Nonconformities are recorded, documented, and tracked in the incident and corrective action log.
    
    The effectiveness of corrective actions is reviewed.

14. Explain the Management of Improvement

    Changes to the information security management system are planned and managed.
    
    Changes to the information security management are recorded in the incident and corrective action log or in a change log, as appropriate and relevant.

15. Describe the process for policy compliance

    Set how compliance with the policy will be measured and enforced.