ISO 27001 Continual Improvement Policy: Ultimate Guide

Introduction

In this ultimate guide I show you everything you need to know about the ISO 27001 Continual Improvement Policy and exactly what you need to do to satisfy it to gain ISO 27001 certification.

We will get to grips with what continual improvement is, understand why organisations need a Continual Improvement Policy, show you how to write one, and let you in on trade secret’s that’ll save you hours of time and effort.

I am Stuart Barker: founder of High Table, Information Security expert and ISO 27001 Ninja, and this is the ISO 27001 Continual Improvement Policy.

What is a Continual Improvement Policy?

The Continual Improvement Policy sets out the guidelines and the framework for how you manage when you identify that things are not working as intended.

This Continual Improvement Policy is about maintaining an effective information security management system so it continues to meet is intended goals.

ISO 27001 Continual Improvement Policy Template

The Continual Improvement Policy Template is part of the Ultimate ISO 27001 Toolkit and also exclusively available stand-alone. It is prewritten, fully populated and ready to go and fully complies with ISO27001:2022.

What is the purpose of the ISO 27001 Continual Improvement Policy?

The purpose of the ISO 27001 Continual Improvement Policy is the continual improvement of the suitability, adequacy, and effectiveness of the information security policy and information security management system.

What is the ISO 27001 Continual Improvement Principle?

The information security management system is continually improved and enhanced through addressing incidents and non-conformities with an effective corrective action and management process.

Why is the ISO 27001 Continual Improvement Policy Important?

Things change. When we first build and implement our information security management system things will operate effectively but the standard recognises that things are not perfect. There is always room for improvement.

In addition changes will occur within the organisation. Some of these will be intentional and some of these will be unintentional.

As changes occur then the information security management system will need to adapt.

If the management system does not adapt, then either incidents will occur or the process of audit will identify areas that are not longer working as intended.

All of this is fine and part of the natural process.

This policy is important because it sets out clearly how you identify these non-conformities and then how you manage and address them.

What should the ISO 27001 Continual Improvement Policy Contain?

The ISO 27001 Continual Improvement Policy is required to be presented in a certain way. What we mean by that is that the policy is expected to have certain document markup. Document mark up is just a fancy words for having certain information on the policy. It will need version control, a version number, an owner, an information security classification. An example table of contents would look something like this:

Document Version Control
Document Contents Page
Continual Improvement Policy
Purpose
Scope
Principle
Audit
Internal Audits
External Certification Audits
Client and Third-Party Audits
Incidents
Change Management
Management Review Team
Review of Objectives
Legal, Regulatory and Information Security Standards Change
Improvement as a result of Non-Conformity
Management of Improvement
Policy Compliance
Compliance Measurement
Exceptions
Non-Compliance
Continual Improvement
Areas of the ISO27001 Standard Addressed

How to write an ISO 27001 Continual Improvement Policy

It can be straight forward to write a Continual Improvement Policy. These are the steps that you would take.

Implementation Summary Steps

1. Define the policy purpose
2. Define the policy scope
3. Define the policy principle
4. Set out what we do for both internal and external audits and the role that they have in continual improvement.
5. Lay out how we manage incidents
6. Describe how we manage change
7. Describe the role of the management review team and oversight
8. Set out the approach to information security objectives review
9. Understand any legal and regulatory change impact
10. Set out the approach to managing improvement

Contents Page

First we are going to look at the contents page and insert a contents table.

Continual Improvement Policy Purpose

We record the purpose of the policy. An example of the purpose is – the continual improvement of the suitability, adequacy, and effectiveness of the information security policy and information security management system.

Continual Improvement Policy Scope

Scope is all employees and third party users and also the information security management system (ISMS).

Continual Improvement Policy Principle

The principle is the information security management system is continually improved and enhanced through addressing incidents and non-conformities with an effective corrective action and management process.The information security management system is continually improved and enhanced through addressing incidents and non-conformities with an effective corrective action and management process.

Audit

There is a lot of guidance in the blogs and on the YouTube on audit and we are going to consider both internal and external audits for our policy.

Internal Audits

Internal audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.

Internal audits are conducted based on risk and business need.

Internal audits are conducted by individuals independent of the area being audited.

Internal audits are planned for the year.

Internal audit results are reported to and overseen by the Management Review Team.

Internal audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

External Certification Audits

External certification audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.

External certification audits are conducted based on the certification body requirements.

External certification audits are planned for the year.

External certification audits results are reported to and overseen by the Management Review Team.

External certification audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

Client and Third Party Audits

Client and third-party audits are conducted to assess the effectiveness of the information security management system and the controls documented in the Statement of Applicability.

Client and third-party audits are conducted based on agreement and subject to a contract and / or non-disclosure agreement being in place.

Client and third-party audits results are reported to and overseen by the Management Review Team.

Client and third-party audits may result in a nonconformity requiring a corrective action or identifying an opportunity for improvement.

Incidents

Whilst you will have an incident management process and likely an incident management professional who can help here, our continual improvement policy is going to set out the role incidents play for continual improvement.

Change Management

Change management will consider and may identify an opportunity for improvement.

Management Review Team

The management review team has an oversight role.

The management review team as part of the structured management review team agenda consider opportunities for improvement.

Review of Objectives

The review of information security objectives will consider and may identify an opportunity for improvement.

Legal, Regulatory and Information Security Standards Changes

Changes as a result of legal and regulatory requirements or changes to applicable standards for information security will consider and may identify an opportunity for improvement.

Improvement as a result of Non-Conformity

A non-conformity is a deviation from the norm. This is defined as a deviation from policy and / or process.

Nonconformity to process or policy is identified by the audit process and the occurrence of incidents.

When a nonconformity occurs, action is taken to correct it and deal with the consequences.

Nonconformities are evaluated for the need to eliminate the causes of the non-conformity in order that it does not reoccur or occur elsewhere:

• Reviewing the non-conformity
• Determining the cause of the non-conformity
• Determining if similar nonconformities exist or could potentially occur.

Nonconformities are reported through the Management Review Team.

Nonconformities are recorded, documented, and tracked in the incident and corrective action log.

The effectiveness of corrective actions is reviewed.

Management of Improvement

Changes to the information security management system are planned and managed.

Changes to the information security management are recorded in the incident and corrective action log or in a change log, as appropriate and relevant.

Compliance Section

And then within our policy as we complete our policy we can see that we have the compliance section that is covered on other tutorials.

ISO 27001 Continual Improvement Policy Example

This is a great example of the Continual Improvement Policy. Taking the first 3 pages being the contents of what it includes.

What are the benefits of ISO 27001 Continual Improvement Policy?

Other than your ISO 27001 certification requiring it, the following are benefits of having the ISO 27001 Continual Improvement Policy:

1. Improved security: You will address non-conformities in your information security management operation and keep paces with changes, ensuring that you continue to meet your information security objectives.
2. Reduced risk: Ensuring that the management system is audited, reviewed and incidents are managed will reduce the risk of attack and exploit
3. Improved compliance: Standards and regulations require that you monitor the effectiveness of your management system and continual improve.
4. Reputation Protection: In the event of a breach having effective continual improvement management will reduce the potential for fines and reduce the PR impact of an event

Who is responsible for the ISO 27001 Continual Improvement Policy?

This will depend on the structure and make up of your organisation. If you have a quality manager then it will sit them. Otherwise, responsibility will be assigned the information security manager.

Who is responsible for implementing the ISO 27001 Continual Improvement Policy?

The implementation of continual improvement is the responsibility of the area or function where the non-conformity has occurred.

How do you monitor the effectiveness of the ISO 27001 Continual Improvement Policy?

The approaches to monitoring the effectives of continual improvement include:

1. Obtaining relevant industry information security certificates
2. Internal audit of the continual improvement process
3. External audit of the continual improvement process
4. Review of incidents and changes

What are examples of a violation of the Continual Improvement Policy?

Examples of where the policy can fail or violations of the ISO 27001 Continual Improvement Policy can include:

• Not conducting internal audits
• Not recording the results of audits
• Not responding to non-conformities that are identified

What are the consequences of violating the ISO 27001 Continual Improvement Policy?

Not managing non-conformities can have severe consequences for information security and the confidentiality, integrity and availability of data and systems. 

The consequences could be legal and regulatory fines and / or enforcement, loss of data, loss of revenue, loss of clients and customers, negative PR.

How often is the Continual Improvement Policy reviewed?

The Continual Improvement Policy is reviewed after any significant change that affects the organisation and at least annually.

ISO 27001 and the ISO 27001 Continual Improvement Policy

The following are ISO 27001 controls relevant to continual improvement to consider for further reading:

ISO 27001 Clause 10.1 Continual Improvement

ISO 27001 Clause 10.2 Nonconformity and Corrective Action