Clause 10

Improvement

Keep getting better: continually improve, and handle nonconformities with corrective action.

Mandatory documents in this clause

✓Nature of nonconformities and actions taken (10.2)
✓Results of corrective actions (10.2)

10.1

Continual improvement

What it requires: Continually improve the suitability, adequacy and effectiveness of the ISMS.

How to meet it: Feed audit findings, incidents, and review outputs into an improvement backlog.

10.2

Nonconformity and corrective action

What it requires: When a nonconformity occurs, react to control and correct it and deal with the consequences; evaluate whether to eliminate the cause (review it, find the cause, check for similar issues); implement action, review its effectiveness, and change the ISMS if needed. Keep evidence of the nonconformity, actions, and results.

How to meet it: Run a corrective-action log with root-cause analysis and effectiveness checks.

ISO 27001 policy templates

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

Nonconformity and corrective action procedureHandles clause 10.1 end to end: raising nonconformities, containment, root cause, corrective action and effectiveness checks.Incident response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident response, PCI DSS 12.10, and security event handling.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Data breach response policyUse for ISO 27001 A.5.24 to A.5.28, SOC 2 incident handling, privacy notification, and PCI DSS requirement 12.10.

Open the control-to-policy map

← Clause 9: Performance evaluation

Looking for the Annex A controls? See all 93 controls. To run these requirements with automation, read how AI manages compliance.