1.0 Purpose
The purpose of this procedure is to continually improve the suitability, adequacy and effectiveness of the established ISMS. continual improvement requires measuring the effectiveness and efficiency of technology, people and processes and adapting to inevitable changes in the environment – technical, organisational or otherwise
2.0 Scope
This procedure applies to continual improvement in the ISMS for all identified processes
3.0 Responsibility:
3.1 Department/section heads: To identify the “areas of improvement” and to implement the improvement in the section after getting the approval from the Top Management.
3.2 Management representative: To remind the department/section heads/process owners about the continual improvement and request to present the status to the Top Management
3.3 CISO : To approve the continual improvement plans which may improve the Information Security management system. To ensure that there is adequate resources for the plan and to monitor the status reports from the department/ section heads/process owners.
4 Procedure:
The respective department/section heads shall identify the areas for improvement based on the policy, objectives and strategic plans of the organization. The areas of improvement shall be based on:
- improvements in strategy (i.e. why things are done): Improving strategy improves or maintains the suitability of an ISMS and requires improving knowledge and understanding of the environment and threat landscape.
- improvements in practice (i.e. what is done): Improving practice can increase the effectiveness of the ISMS and resulting security controls.
- improvements in process (i.e. how things are done):Improving processes can increase the efficiency of controls and surrounding processes.
Improvements can be made in the short or long term. However most improvements will follow the process below:
- Identify opportunity for improvement.
- Identify root cause (as applicable).
- Allocate responsibility for implementing change.
- Identify, analyse and evaluate (based on cost vs benefit) possible solutions.
- Plan implementation of changes.
- Implement changes.
- Measure effectiveness of actions
4.1 Steps in an improvement process
| Process | Example activities |
| 1.Define what you should measure | Identify technical, operational and strategic goals Define what you will measure |
| 2.Define what you can measure | Scoping Risk assessment and risk treatment plans Identify the strategy for improvement |
| 3. Gather the data 4. Process the data | Implement improvement plans Implement controls, services monitoring etc. |
| 5. Analyse the data | Analyse gathered data (e.g. from monitoring) Carry out gap analysis Internal and external audits |
| 6. Present and use the information 7. Implement corrective action | Implement corrective actions and fixes; Record lessons learned Feed back and report |
The departmental/section heads shall identify and document the areas of improvement in the Continual Improvement Plan (F 012) form and send it to the management representative (MR) for review. The management representative (MR) shall review and send the plan to the CISO for final approval. Respective departmental personnel shall make prioritized action plan for the areas of continual improvement and the same shall be followed to complete the assignment in time. Respective departmental/section head shall review the status of the continual improvement plan. and the status of the plan shall be presented to the management during management review meetings. The effectiveness of continual improvement plans shall be monitored and reviewed periodically and the same shall be discussed in MRM.
4.2 Sources of information and opportunities for improvement
| Opportunity for improvement | Sources of information |
| Organisational changes | Meetings with top management Departmental/organisational announcements, news bulletins etc. |
| Changes in business requirements/circumstances | Third party requirements Public media and news Security/business conferences Team meetings Management reviews Service reviews |
| Change in security requirements | Policy reviews Information security incidents Service requests Change requests Bulletins and announcements |
| Changes in regulatory environment | Notifications from suppliers Notifications from third parties Notification from statutory bodies e.g. the Information Commissioner’s Office Internal security forums Security mailing lists |
| Contact with Special Interest Groups | Security conferences and community meetings Security mailing lists |
| Changes in skill sets | Recruitment of new staff Knowledge gained from training |
| User/customer engagement | Service requests User satisfaction surveys Knowledge bases |
| Service requests | Service desk management tools Knowledge bases |
| Risk assessments | Risk assessment outputs Gap analysis reports |
| Vulnerabilities | Vendor vulnerability announcements Security community mailing lists Results from penetration testing and vulnerability scanning Log files Service requests and notifications from users/customers |
| Information security incidents | Intrusion detection/prevention system alerts Log files and network flows Knowledge gained from analysing and resolving incidents |
| Internal audit and review | Review meetings Policy reviews Audit reports Vulnerability scanning and penetration testing reports Security reviews |
| External audits | Review meetings Audit reports Vulnerability scanning and penetration testing reports Security reviews |
5 Reference:
Continual Improvement Plan
