ISO 27001 · Step-by-step series · Article 7 of 7

ISO 27001 Clause 10: Improvement, Nonconformity and Corrective Action

Clause 10 is the final clause of ISO 27001:2022 and closes the loop of the Plan-Do-Check-Act cycle that runs through the entire standard. After you have planned your ISMS (clauses 4-6), operated it (clause 8), and evaluated its performance (clause 9), clause 10 asks a simple but demanding question: what do you do with what you learned? This closes our seven-part series on ISO 27001:2022 — read on for a complete breakdown of nonconformity handling, corrective action, and continual improvement.

Structure of clause 10: two subclauses, one philosophy

In the ISO 27001:2022 revision, clause 10 was reordered compared to the 2013 version — continual improvement now appears as 10.1 and nonconformity/corrective action as 10.2, the reverse of the earlier structure. The content is essentially the same, but the reordering reflects a philosophical shift: improvement is framed as the ongoing, proactive discipline, with corrective action as one specific mechanism that feeds it. The two subclauses are:

• 10.1 Continual improvement: the organization shall continually improve the suitability, adequacy and effectiveness of the ISMS.
• 10.2 Nonconformity and corrective action: what to do when something doesn't conform to ISMS requirements — react, evaluate, act on the cause, and review effectiveness.

10.1 Continual improvement: more than a slogan

Clause 10.1 is short in wording but broad in scope. It requires the organization to continually improve the suitability, adequacy and effectiveness of the information security management system. Unlike 10.2, it isn't triggered by a specific nonconformity — it is the ongoing expectation that the ISMS gets better over time, drawing on inputs from across the whole standard: audit results, monitoring and measurement (9.1), management review outputs (9.3), risk assessment updates (6.1.2, 8.2), incident trends, and changes in the external and internal context (clause 4).

In practice, continual improvement shows up as a recurring pattern rather than a single documented procedure:

• Trend analysis across cycles: comparing internal audit findings, incident volumes, and risk treatment progress year over year, not just reacting to isolated events.
• Statement of Applicability evolution: as the organization's risk landscape and Annex A control implementation mature, the SoA is revisited and justifications updated, not left static after certification.
• Feedback loops from operations to planning: lessons from clause 8 operational security incidents feeding back into clause 6 risk treatment plans.
• Objective-setting discipline: information security objectives (6.2) are periodically reviewed and, where achieved, replaced with more ambitious ones rather than being quietly dropped.

10.2 Nonconformity and corrective action: the structured response

Clause 10.2 is where ISO 27001 gets prescriptive. When a nonconformity occurs — a failure to meet a requirement of the ISMS, whether a clause 4-10 management requirement or an Annex A control implementation gap — the organization must follow a defined sequence of steps. The standard requires the organization to:

Clause 10.2 also requires that corrective actions be appropriate to the effects of the nonconformities encountered — a proportionality principle. A minor documentation gap does not need the same investigative depth as a nonconformity that led to a data breach. The standard also requires retained documented information as evidence of: the nature of the nonconformities and any subsequent actions taken, and the results of any corrective action.

Where nonconformities typically come from

A nonconformity under clause 10.2 is not limited to what an external auditor finds. In a mature ISMS, most nonconformities are identified internally, long before a certification audit. Common sources include:

• Internal audits (9.2): the most structured and frequent source of documented nonconformities.
• Security incidents: an incident often reveals that a control (encryption, access review, patching cadence) wasn't operating as designed.
• Monitoring and measurement (9.1): metrics falling outside target thresholds — for example, a patching SLA consistently missed — can itself constitute a nonconformity.
• Management review (9.3): leadership may identify that an ISMS objective isn't being met or that resourcing is insufficient for a control to function.
• Third-party or supplier assessments: a supplier security review under Annex A control 5.19-5.23 may surface gaps in how supplier risk is actually managed.
• Employee or stakeholder reports: staff flagging that a procedure is unworkable in practice, or that they've had to bypass a control to get work done.

Common audit findings on clause 10

Across certification and surveillance audits, the same weaknesses in clause 10 implementation tend to recur:

• Corrections without root cause analysis: the immediate symptom is fixed (a misconfigured firewall rule is corrected) but no one asks why the misconfiguration was possible in the first place, so it recurs weeks later.
• No effectiveness review recorded: the corrective action is marked "closed" the day it's implemented, with no follow-up check weeks or months later to confirm it actually worked.
• Nonconformity register that only reflects external audit findings: a healthy ISMS should show internally-raised nonconformities too — a register with zero self-identified issues is itself a red flag to auditors.
• Corrective actions not linked back to the Statement of Applicability: when a nonconformity reveals an Annex A control gap, the SoA and its justification are not updated to reflect the change.
• Continual improvement treated as a paperwork exercise: an "improvement plan" document exists but has no traceable link to actual audit findings, incidents, or management review outputs.

Frequently asked questions about ISO 27001 clause 10

Does ISO 27001:2022 still require a formal "preventive action" process like the 2013 version implied?

Not as a separate, named process. Like other Annex SL-based standards, ISO 27001 folds the concept of preventive action into risk assessment and treatment (clauses 6.1.2 and 8.2, refreshed continuously) and into continual improvement (10.1). The logic is that a properly functioning ISMS is already forward-looking through ongoing risk assessment, so a separate reactive-sounding "preventive action" procedure duplicates what risk management is meant to do. Auditors will look for evidence that risks are being anticipated through the risk process, not for a standalone preventive action log.

What's the difference between a correction and a corrective action under clause 10.2?

A correction is the immediate fix for the nonconformity itself — resetting an access permission, restoring a misconfigured control, containing an incident. A corrective action goes further: it investigates why the nonconformity occurred and implements changes to prevent recurrence. Clause 10.2 requires both — you cannot skip straight to "fixed it" without also asking why it happened, and you cannot investigate root cause endlessly without also containing the immediate problem.

Do all nonconformities require a full root cause analysis?

Clause 10.2 requires corrective actions to be appropriate to the effects of the nonconformities encountered, which is a proportionality test rather than a blanket requirement for the same depth of investigation every time. A minor, one-off documentation gap with no security impact may warrant a brief review. A nonconformity connected to a security incident, a repeated pattern, or a control failure with real risk exposure warrants a more thorough root cause analysis. The judgment on proportionality should itself be documented so an auditor can see the reasoning, not just the conclusion.

How long should nonconformity and corrective action records be retained?

ISO 27001 does not specify a fixed retention period for clause 10.2 records — it requires that documented information be retained as evidence, with the specific period left to the organization's own documented information control procedure (clause 7.5). In practice, most organizations retain nonconformity and corrective action records for at least the length of one full certification cycle (three years) so that trends can be reviewed across surveillance audits, and many retain them longer to support long-term trend analysis under 10.1.

Can a certification body issue a nonconformity against clause 10 itself, or only against the clauses where the underlying failure occurred?

Both are possible, and they represent different findings. If a control fails (for example, an Annex A access control gap), the nonconformity is typically raised against that specific requirement. But if the organization's process for reacting to, investigating, and closing out that failure is itself absent or inadequate — no root cause analysis, no effectiveness review, no retained evidence — that is a separate nonconformity against clause 10.2 itself, on top of the original finding. It is common for a single audit to raise both simultaneously: one for the technical or procedural gap, and one for the weak corrective action process that failed to catch or resolve it.

Is continual improvement (10.1) actually audited, given how broad it sounds?

Yes. Auditors typically test 10.1 by asking for concrete examples of how the ISMS has changed over time as a result of learning — not a policy statement that improvement happens, but a traceable link between a specific input (an audit finding, an incident trend, a management review decision) and a specific change (an updated control, a revised objective, a retired ineffective practice). An ISMS that looks identical cycle after cycle, with no evolution in its objectives, risk treatment, or controls despite ongoing operation, raises the question of whether 10.1 is being met in substance rather than just in a paragraph of the policy manual.

How does clause 10 connect back to clause 4 at the start of the standard?

Clause 10 closes the Plan-Do-Check-Act cycle that clause 4 (Context of the Organization) opens. Improvements identified through clause 10 — new risks discovered through incident root cause analysis, changed stakeholder expectations surfaced during management review — should feed back into how the organization understands its context, its interested parties, and the scope of its ISMS in clause 4. This is what makes ISO 27001 a management system rather than a one-time compliance checklist: the output of clause 10 becomes an input to clause 4 in the next cycle.

Expert ISO 27001 · Updated 2026-07-31 · ISO 27001 step-by-step series: Article 1 — Clause 4 · Article 2 — Clause 5 · Article 3 — Clause 6 · Article 4 — Clause 7 · Article 5 — Clause 8 · Article 6 — Clause 9