ISO 27001 Clause 10: Correct Findings and Improve
ISO 27001 clause 10 turns security findings into changes that improve the ISMS. It covers continual improvement in clause 10.1 and nonconformity and corrective action in clause 10.2. The practical distinction matters: fixing one exposed folder can stop the immediate problem, while addressing why the folder became exposed can prevent the same weakness across other projects.
What clause 10 requires in practice
Clause 10 deals with improvement and has two parts. Continual improvement requires the organisation to keep improving the suitability, adequacy and effectiveness of the ISMS, making it a standing duty rather than a periodic project. Nonconformity and corrective action sets out what happens when something goes wrong. The organisation reacts, which means controlling and correcting the problem and dealing with its consequences. It then evaluates whether action is needed on causes so the problem does not recur or appear elsewhere, by reviewing the nonconformity, finding causes and checking for similar cases. Any needed action is carried out, its effectiveness reviewed and the ISMS changed where necessary. Corrective actions must suit the effects of the nonconformity. Records must show the nature of the nonconformities, actions taken and corrective action results.
10.1: improve the management system as the business changes
The organisation continually improves the suitability, adequacy and effectiveness of the ISMS. Improvement can arise from risk evaluation, audit, management review, operating experience or changes in the business. It is broader than responding to formal findings. A system can meet its current requirements while still offering opportunities to reduce unreliable manual handovers or make responsibilities clearer.
Imagine a construction group opening temporary project offices. Its account-closure process works, but each project manager interprets the handover differently. The group pilots a clearer notification and ownership arrangement before a finding occurs. It measures whether closure becomes more timely and whether exceptions remain visible. This is an original example of proactive improvement, not a claim that ISO requires a particular workflow or technology.
A useful improvement should connect with an intended outcome. Rewriting a policy into a newer design may improve readability, but the organisation should understand whether that addresses an actual problem. More documents, more controls or more software do not automatically make an ISMS more effective.
Why correcting findings and improving matters to the business
Every organisation has incidents, audit findings and near misses. What distinguishes a resilient one is what it does next. Fixing only the symptom lets the same fault return in a different department, with the cost of repeated disruption and the loss of customer confidence. Root cause thinking turns each failure into a lasting improvement and builds a visible record of learning, which customers and assessors treat as a sign of maturity. Proportionality matters too: a minor slip should not trigger heavy bureaucracy, while a serious breach deserves thorough analysis. Done well, this clause lowers long-term cost and helps the ISMS keep pace with the business and its threats.
How to implement clause 10
The routine should be simple enough that people use it for small issues as well as large ones. A workable sequence follows. Use the same routine for audit findings, incidents and customer complaints, so that learning from every source reaches the same place.
- Define what counts as a nonconformity for your ISMS, covering audit findings, incidents, control failures and customer complaints.
- Log each one in a single place with an owner, so nothing is handled informally and lost.
- Contain and correct the immediate problem first, and assess any consequences for customers or data.
- Analyse the cause with a method that suits the issue, from a few questions for small matters to a structured review for serious ones.
- Check whether the same fault exists elsewhere, and extend the fix where it does.
- Agree actions proportionate to the effect, carry them out, and later check that they worked.
- Feed lessons into the management review as improvement opportunities, and change procedures or controls where the evidence supports it.
10.2: respond to the nonconformity and its consequences
When a nonconformity occurs, the organisation reacts as applicable by controlling and correcting it and dealing with consequences. It then evaluates the need for action to remove causes, so the issue does not recur or arise elsewhere. This includes reviewing the problem, determining causes and considering similar existing or potential nonconformities. Necessary action is implemented, effectiveness is reviewed, and the ISMS is changed if needed. Actions should be appropriate to the effects of the problem.
In a hypothetical BPO business, an employee sends a customer report through an unapproved transfer route. The immediate response might include restricting further sharing, securing the data and following relevant contractual and incident processes. Investigation then discovers that the approved transfer route rejects a file size routinely needed for the work. Retraining the employee without addressing that operational mismatch would leave the pressure to bypass the process intact.
Corrective action might therefore involve an approved transfer option, revised operating guidance and a check of other teams with the same workload. These are possible responses, not a universal answer. The actual action depends on the findings, risk, responsibilities and applicable requirements.
Keep correction, corrective action and incident handling distinct
Correction addresses the detected issue. Corrective action addresses its cause to prevent recurrence or occurrence elsewhere. An incident can reveal a nonconformity, but an incident and a management-system nonconformity are not identical concepts. Investigate what requirement was not fulfilled rather than automatically labelling every alert as an ISO finding.
Suppose a software company detects an attempted attack that its designed controls successfully block. That event may provide useful intelligence without demonstrating a nonconformity. Conversely, an overdue access review can be a nonconformity even when no attack or loss has been detected. This distinction helps the team direct investigation effort and avoid misleading management reports.
Resolve findings with an evidence-based approach
Discuss ISMS improvement and corrective-action support with Sterling, including investigation assistance, agreed access to Effivity ISO & GRC automation software and preparation evidence. Enrol in Root Cause Analysis & CAPA for a relevant learning route. Support and learning do not determine an independent certification body's decision.
Previous: clause 9. Return to the ISO 27001 requirements hub; a useful next step is to revisit risk planning in clause 6 when findings change your understanding of risk.
Explore each numbered part
10.1 · Continual improvement of the ISMS
Continual improvement means making the ISMS more suitable, adequate and effective as the business and its risks evolve. Learn to choose improvements from evidence, test whether they help and avoid confusing tool purchases with better outcomes. Examples distinguish proactive improvement from corrective action and explain how small changes can strengthen the whole system.
10.2 · Nonconformity and corrective action
Respond to requirement failures in a way that fixes the immediate problem and addresses why it happened. Learn to distinguish correction from corrective action, consider similar failures elsewhere and evaluate effectiveness. Practical examples show how to build an evidence trail without defaulting to blame, generic retraining or premature closure.
Illustrative example: improvement
A hypothetical Australian laboratory finds during an internal audit that two analysts shared a login to the results system. The immediate correction is to issue individual accounts and review recent activity for unexplained changes. The quality lead then asks why sharing happened and learns that account requests took too long for temporary staff. Checking elsewhere, the team finds a similar workaround on the instrument control computer. The corrective action speeds up account creation, adds a temporary-staff step to induction and replaces the shared instrument login. Three months on, an auditor samples new starters and observes that accounts are created on arrival. The nonconformity record, the cause analysis and the follow-up check are kept together, and the management review notes the pattern as an improvement.
Frequently asked questions
Must every minor error trigger a major investigation?
The requirement is to evaluate the need for action and respond appropriately to the effects. Proportionality still requires a reasoned decision; it does not mean routinely closing issues without considering causes or similar exposure.
Can training be corrective action?
It can be part of the response when evidence identifies a competence or awareness cause. Training alone is unlikely to resolve unsuitable tools, conflicting incentives or unclear authority.
Does closing the original problem prove corrective action worked?
It demonstrates correction of that instance. Effectiveness review should examine whether the action addressed the cause and the relevant risk of recurrence or occurrence elsewhere.
Demonstrate effectiveness rather than administrative closure
Clause 10.2 requires retained information on the nature of nonconformities, subsequent actions and corrective-action results. Useful evidence explains the problem, its consequences, the cause assessment, the chosen action and how effectiveness was checked. ISO does not prescribe a single root-cause tool or a universal closure deadline.
An auditor may compare the original finding with implementation evidence and later operating results. If the action was meant to prevent delayed account closure across projects, reviewing only the corrected original account is insufficient to test that wider purpose. Select a meaningful follow-up sample and allow enough operating experience to support the conclusion. Where results remain uncertain, say so and decide what further check is needed.