You show continual improvement in ISO 27001 with dated records that link a finding to a change: a metric or audit result, a decision at management review, an action, and a later result. Clause 10.1 asks that the ISMS keep improving so security stays appropriate and performs as expected. A policy line saying so is not enough.
What the standard asks
A public guide to clause 10 says it covers nonconformities, corrective action and continual improvement. Clause 10.1 requires continually improving the ISMS so security is appropriate and performs as expected. Clause 10.2 deals with nonconformities: act to reduce consequences and remove the root cause, then evaluate and document whether the action worked.
Where improvement evidence comes from
Clause 9 supplies most of the raw material. According to a guide to clause 9, it requires monitoring and measuring performance (9.1), internal audits at planned intervals (9.2) and management reviews (9.3). Each can produce an improvement.
| Source | Typical improvement |
|---|---|
| Metric trend | Faster patching after a slow month |
| Internal audit finding | A missing log review process added |
| Incident review | Alerting rules changed after a near miss |
| Customer feedback | Clearer onboarding steps for security requests |
| Management review | Resources approved for a gap |
A simple improvement log
Keep one table with these columns: date, source, what was found, what changed, owner, and how you checked it worked. Ten honest rows over a year beat a long list of cosmetic ones.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how ongoing checks create a trail of changes over time.
Make metrics worth measuring
Pick a few numbers you can influence and explain. Time to close high severity vulnerabilities. Share of laptops with disk encryption on. Percentage of leavers whose access was removed on the last day. Review them monthly. When a number moves the wrong way, record what you did.
Tie improvements to nonconformities
When you find a nonconformity, record the correction, the root cause and the corrective action, and then check the effect. For the steps, see the corrective action process. Auditors like to see that the same issue did not return.
What not to do
- Do not invent improvements for the audit week.
- Do not mark an action done without checking the result.
- Do not hide minor issues. A small, fixed issue with a record is evidence the system works.
Quick check
How many improvements does an auditor expect?
There is no fixed number in the clause. Show a process that finds issues and acts on them, with records. Ask your certification body about its sampling.
Is continual improvement the same as corrective action?
No. Corrective action responds to a specific nonconformity. Continual improvement is the broader, ongoing effort to make the ISMS better.
Safeguard's continuous monitoring and compliance automation can supply trend data for your metrics. The improvements still have to be decided and made by your team.
Sources
Last reviewed: 19 October 2026.
