What supports the continual improvement of an ISMS?

Continual improvement, a core requirement of ISO/IEC 27001 (Clause 10.2), involves enhancing the ISMS's suitability, adequacy, and effectiveness. The ISMS is fundamentally defined and operated through its documented information (Clause 7.5), such as policies, procedures, and records. When an improvement is implemented, updating the relevant documented information is the mechanism that formally integrates the change into the management system. This ensures the improvement is embedded, becomes repeatable, is communicated consistently, and provides an auditable baseline for future performance evaluation. Without updating documentation, improvements remain informal and risk being lost over time.

B. The update of action plans is a project management task for tracking improvement activities, not the formal integration of the improvement into the ISMS itself.
C. Audit reports are static records of findings at a specific point in time; they serve as inputs to the improvement process, not documents that are updated.

1. ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection — Information security management systems — Requirements.

Clause 10.2 Continual improvement: "The organization shall continually improve the suitability, adequacy and effectiveness of the information security management system." This clause establishes the overarching requirement.

Clause 7.5 Documented information: This clause specifies that the ISMS shall include documented information required by the standard and necessary for its effectiveness. Any formal improvement to a process or control must be reflected here to be considered part of the ISMS.

Clause 10.1 Nonconformity and corrective action, item e): States the organization shall "make changes to the information security management system, if necessary." These changes are formalized through updates to documented information.

2. Calder, A., & Watkins, S. G. (2019). ISO 27001/ISO 27002: A Pocket Guide (4th ed.). IT Governance Publishing.

Chapter 6, 'Clause 10: Improvement': The guide explains that the 'Act' stage of the PDCA cycle involves taking actions to improve ISMS performance. These actions result in changes to the ISMS, which must be reflected in the relevant documentation to ensure the improvements are sustained.

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House.

Section 11.3, 'Continual Improvement': This section emphasizes that the outputs of management reviews, audits, and corrective actions often lead to changes in ISMS documentation. "The ISMS documentation is a living set of documents and must be updated to reflect the changes made to the ISMS." (p. 168). This directly links the act of improvement to the necessity of updating documentation.