This chapter ensures that the organization addresses nonconformities and continually improves the ISMS. It contains two sub-clauses:
10.1 Nonconformity and corrective action
The organization must:
- React to nonconformities and control their consequences.
- Investigate the causes.
- Implement corrective actions to prevent recurrence. (In practice: use root cause analysis and track corrective actions.)
10.2 Continual improvement
The organization must continually improve the suitability, adequacy, and effectiveness of the ISMS.
