ISO 27001:2022 Example of Procedure for continual improvement

1.0 Purpose

The purpose of this procedure is to continually improve the suitability, adequacy and effectiveness of the established ISMS. continual improvement requires measuring the effectiveness and efficiency of technology, people and processes and adapting to inevitable changes in the environment – technical, organisational or otherwise

2.0 Scope

This procedure applies to continual improvement in the ISMS for all identified processes

3.0 Responsibility:

3.1 Department/section heads: To identify the “areas of improvement” and to implement the improvement in the section after getting the approval from the Top Management.

3.2 Management representative: To remind the department/section heads/process owners about the continual improvement and request to present the status to the Top Management

3.3 CISO : To approve the continual improvement plans which may improve the Information Security management system. To ensure that there is adequate resources for the plan and to monitor the status reports from the department/ section heads/process owners.

4 Procedure:

The respective department/section heads shall identify the areas for improvement based on the policy, objectives and strategic plans of the organization. The areas of improvement shall be based on:

  • improvements in strategy (i.e. why things are done): Improving strategy improves or maintains the suitability of an ISMS and requires improving knowledge and understanding of the environment and threat landscape.
  • improvements in practice (i.e. what is done): Improving practice can increase the effectiveness of the ISMS and resulting security controls.
  • improvements in process (i.e. how things are done):Improving processes can increase the efficiency of controls and surrounding processes.

Improvements can be made in the short or long term. However most improvements will follow the process below:

  • Identify opportunity for improvement.
  • Identify root cause (as applicable).
  • Allocate responsibility for implementing change.
  • Identify, analyse and evaluate (based on cost vs benefit) possible solutions.
  • Plan implementation of changes.
  • Implement changes.
  • Measure effectiveness of actions

4.1 Steps in an improvement process

Process Example activities
1.Define what you should measureIdentify technical, operational and strategic goals
Define what you will measure
2.Define what you can measureScoping
Risk assessment and risk treatment plans
Identify the strategy for improvement
3. Gather the data
4. Process the data

Implement improvement plans
Implement controls, services monitoring etc.
5. Analyse the dataAnalyse gathered data (e.g. from monitoring)
Carry out gap analysis
Internal and external audits
6. Present and use the information
7. Implement corrective action
Implement corrective actions and fixes;
Record lessons learned
Feed back and report

The departmental/section heads shall identify and document the areas of improvement in the Continual Improvement Plan (F 012) form and send it to the management representative (MR) for review. The management representative (MR) shall review and send the plan to the CISO for final approval. Respective departmental personnel shall make prioritized action plan for the areas of continual improvement and the same shall be followed to complete the assignment in time. Respective departmental/section head shall review the status of the continual improvement plan. and the status of the plan shall be presented to the management during management review meetings. The effectiveness of continual improvement plans shall be monitored and reviewed periodically and the same shall be discussed in MRM.

4.2 Sources of information and opportunities for improvement

Opportunity for improvementSources of information
Organisational changesMeetings with top management
Departmental/organisational announcements, news bulletins etc.
Changes in business requirements/circumstancesThird party requirements
Public media and news
Security/business conferences
Team meetings
Management reviews
Service reviews
Change in security requirementsPolicy reviews
Information security incidents
Service requests
Change requests
Bulletins and announcements
Changes in regulatory environmentNotifications from suppliers
Notifications from third parties
Notification from statutory bodies e.g. the Information Commissioner’s Office
Internal security forums
Security mailing lists
Contact with Special Interest GroupsSecurity conferences and community meetings
Security mailing lists
Changes in skill setsRecruitment of new staff
Knowledge gained from training
User/customer engagementService requests
User satisfaction surveys
Knowledge bases
Service requestsService desk management tools
Knowledge bases
Risk assessmentsRisk assessment outputs
Gap analysis reports
VulnerabilitiesVendor vulnerability announcements
Security community mailing lists
Results from penetration testing and vulnerability scanning Log files
Service requests and notifications from users/customers
Information security incidentsIntrusion detection/prevention system alerts
Log files and network flows
Knowledge gained from analysing and resolving incidents
Internal audit and reviewReview meetings
Policy reviews
Audit reports
Vulnerability scanning and penetration testing reports
Security reviews
External auditsReview meetings
Audit reports
Vulnerability scanning and penetration testing reports
Security reviews

5 Reference:

Continual Improvement Plan

Leave a Reply