What are the phases of the PDCA cycle?

The PDCA cycle, also known as the Deming Cycle or Shewhart Cycle, is an iterative four-stage model for continuous improvement in business processes and is fundamental to the ISO/IEC 27001 standard. The standard explicitly applies this model for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The phases are:

Plan: Establish ISMS policy, objectives, processes, and controls.

Do: Implement and operate the ISMS policy, controls, and processes.

Check: Monitor, review, and assess the performance of the ISMS.

Act: Take corrective and preventive actions to continually improve the ISMS.

A. Identify, Analyze, Evaluate, Treat: This sequence describes the core activities of the information security risk assessment and risk treatment process (as per ISO/IEC 27005), not the overall management cycle.

C. Initiate, Design, Implement, Operate: This represents a generic project or service lifecycle model, lacking the crucial "Check" and "Act" phases for iterative, continuous improvement central to PDCA.

D. Define, Measure, Analyze, Improve, Control: This is the DMAIC (Define, Measure, Analyze, Improve, Control) methodology, a data-driven improvement cycle used specifically within the Six Sigma framework.

1. International Organization for Standardization (ISO). (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Section 0.4, "Plan-Do-Check-Act model," states, "This document applies the Plan-Do-Check-Act (PDCA) model to all ISMS processes..." It then maps the standard's clauses to the Plan, Do, Check, and Act phases.

2. Moeller, R. R. (2014). Executive's Guide to IT Governance: Improving Systems Processing with CobiT, Val IT, and Risk IT. John Wiley & Sons. In Chapter 11, the PDCA cycle is described as a "four-step management method" consisting of Plan, Do, Check, and Act, and its application in standards like ISO 27001 is highlighted. (This is a peer-reviewed publication from a reputable academic publisher).

3. de la Torre, I., Ortiz, A., & Velasco, M. (2018). A PDCA-based method for the establishment of an information security management system. Computer Standards & Interfaces, 55, 10-22. The abstract and introduction explicitly define the PDCA cycle as "Plan-Do-Check-Act" and frame it as the basis for their ISMS implementation method. https://doi.org/10.1016/j.csi.2017.09.006.