ISO 27001 Clause 10 – Continual Improvement & Corrective Action Guide

Clause 10.2 comes into play when something goes wrong or doesn’t meet the ISMS requirements. A nonconformity is any situation where you find that your ISMS is not in conformity with planned arrangements – in plain terms, a problem or failure in your ISMS (e.g. a missed control, a policy violation, or an incident that shouldn’t have happened). Clause 10.2 requires organizations to react to nonconformities and take corrective actions to control and correct the issue, deal with any consequences, and eliminate the root causes so the problem doesn’t recur. 

To comply with Clause 10.2, your organization should establish a clear corrective action process. Key steps in this process include:

1. React Promptly to the Nonconformity: When a nonconformity is identified (e.g. through an incident report or audit finding), take immediate action to control and correct it. This might involve containing a security incident, fixing a process error, or isolating affected systems. You must also deal with the consequences of the issue – for example, if a data breach occurred, this means notifying stakeholders or regulators as required and remediating any damage. The standard separates “control and correct” from “deal with the consequences” to ensure you manage both the immediate fix and the fallout comprehensively.
2. Investigate and Determine Root Cause: Perform a thorough analysis to identify the cause of the nonconformity, and determine if similar issues exist or could occur elsewhere. Techniques like the “5 Whys” or a fishbone diagram can be useful in digging beyond the surface symptom to uncover underlying causes.
   For instance, if an internal audit finds that backups failed, ask why – maybe the procedure was unclear or a responsible person wasn’t assigned. Continue probing until you find the fundamental issue that needs addressing. Additionally, check if the same root cause might be affecting other areas (could this problem happen in another department or system?). This step is critical for prevention – fixing just the symptom is not enough if the root cause remains.
3. Implement Corrective Actions: Develop and execute a plan to eliminate the root cause identified in step 2. This could mean updating a procedure, providing additional training, fixing a configuration, or other actions so that the nonconformity won’t happen again. Be sure to assign responsibility and deadlines for each action.
   For example, if the root cause of a security incident was an outdated firewall rule, the corrective action might include updating the rule set, auditing other rules for similar issues, and instituting a quarterly review of firewall configurations.
4. Review Effectiveness of the Fix: After implementing corrective actions, evaluate whether they were effective in resolving the issue. Don’t just assume the fix worked – verify it. This may involve follow-up audits, tests, or monitoring to ensure the nonconformity has truly been corrected and hasn’t recurred. If the problem persists or pops up elsewhere, further action might be needed. Clause 10.2 explicitly expects organizations to review the effectiveness of any corrective action taken as part of closing out a nonconformity.
5. Update the ISMS as Necessary: Use what you learned to improve the ISMS. This could mean updating policies, procedures, risk assessments, or controls that were related to the nonconformity. The goal is to make systemic changes so that not only is this issue resolved, but similar issues are less likely to happen.
   For example, if a procedure was unclear and led to an error, revise that procedure document and perhaps provide training on the new guidance. Clause 10.2 effectively ties back into Clause 10.1 here – the lessons from each incident or nonconformity drive continual improvement of the system.
6. Document Everything: Maintain documented information as evidence of the nature of the nonconformity, the actions taken, and the results of those actions. In practice, this means keeping a record (log/report) of each nonconformity and corrective action: what happened, when it was identified, who handled it, what was done to fix it, and how you confirmed it’s resolved. 

Consider maintaining a Nonconformity and Corrective Action Register or using incident tracking software for this purpose. Each entry should link the initial issue to the corrective actions and include references to any updated documents or controls. This makes it easy to review during management meetings or audits.

Certification auditors will often want to see proof of this process in action – for instance, they may ask, “Can you show me an example of a recent security incident or internal audit finding and how you addressed it?”. They expect to find that the organization is not ignoring issues and that there’s an effective, systematic process to correct problems and learn from them.

Clause 10 as a whole is designed to ensure the ISMS keeps improving and becoming more resilient over time, rather than stagnating.