Continual Improvement Register Template (ISO/IEC 27001 clause 10.1)

Improvement opportunities from all sources, triage against nonconformities, benefit and ease scoring, decision, owner, status, benefit review, reporting

SMSI & ISO/IEC 27001StandardISO/IEC 27001:2022 + Amd 1:2024 clauses 10.1 and 9.3 (cited only); ISO/IEC 27003:2017continual improvement registerMis à jour 1 nov. 2026

Ouvrir dans l'éditeurTélécharger .md

Mode d'emploi: Use it to show the ISMS improves, not only fixes nonconformities. Fill the sources and the evaluation rule first, then move existing ideas and audit OFIs in. The main pitfall is a list of ideas with no decision, owner or check that the benefit was achieved.

Aperçu

Continual Improvement Register: [Organization name]

Register of improvement opportunities for the information security management system (ISMS), from every source: audits, management review, incidents, measurement results, staff suggestions, customer feedback and threat intelligence. Each entry is evaluated, decided, owned and tracked to a measured benefit. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 10.1 (making the ISMS fit better, cover more of what it should and work better over time) and the management review input on improvement opportunities (clause 9.3.2) and the decisions on them (clause 9.3.3). Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-088
Version	[1.0]
Status	[Draft / Approved / Superseded]
Owner	[@isms-manager]
Approvers/reviewers	[@steering-committee-chair], [@ciso]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 clauses 10.1 and 9.3
Next scheduled review	YYYY-MM-DD
Register tool	[Spreadsheet / ticketing project / GRC tool]
Decision forum	[ISMS steering committee DOC-ISMS-007 / ISMS manager for low-effort items]

Approvals

Role	Name	Decision	Date
ISMS manager	[@isms-manager]	[Prepared]	YYYY-MM-DD
Steering committee chair	[@chair]	[Approved]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2027-01-20	[@isms-manager]	First approved register
1.1 (Example)	2027-10-02	[@isms-manager]	Added benefit review step after management review feedback
[x.y]	YYYY-MM-DD	[@author]	[Change]

1. Purpose and scope

This register records opportunities to make the ISMS of [Organization name] more suitable (fits the organization and its context), more adequate (covers what it needs to) and more effective (achieves its intended results), within the scope in DOC-ISMS-002. It is the list top management reviews when it considers improvement opportunities, and the place where decisions on them are recorded.

2. Sources

Code	Source	Example input
AUD	Internal or external audit OFI	OFI in the internal audit report DOC-ISMS-084
MR	Management review	Decision in DOC-ISMS-085 to improve a process
INC	Incident and post-incident review	Lesson learned in DOC-ISMS-022 that is not a nonconformity
MEA	Measurement and performance results	Trend in DOC-ISMS-081
RSK	Risk assessment	Cheaper or stronger treatment option found
STF	Staff suggestion	Suggestion channel, awareness session feedback
CUS	Customer or interested party feedback	Questionnaire themes, contract requests
THR	Threat intelligence and technology change	Input from the threat intelligence procedure DOC-ISMS-045
BEN	Benchmarking and new guidance	New standard edition, peer practice

3. Triage: improvement or correction

Ask one question at entry: is any requirement (of the standard, of an ISMS policy, of a contract or of the law) not met today? If yes, the item is a nonconformity and follows clause 10.2 through the findings register; if no, it is an improvement and stays here. An item can produce both: a post-incident review may find a broken control (nonconformity) and a better way to detect the same attack (improvement). Split it into two entries and cross-reference them.

4. Evaluation and decision

Score each entry on two scales (Example rule):

Score	Benefit	Ease
3	Reduces a High or Critical risk, closes a customer or legal requirement, or saves significant effort	Within one team's capacity, no budget, under one month
2	Reduces a Medium risk or improves a measured objective	Needs coordination or a small budget, one to three months
1	Convenience or minor efficiency	Needs budget approval, new tooling or more than three months

Priority = Benefit x Ease, from 1 to 9.

Priority	Default decision (Example rule)	Decided by
6 to 9	Approve and plan	ISMS manager when no budget is needed; steering committee otherwise
3 to 4	Approve when capacity allows, or defer with a revisit date	Steering committee
1 to 2	Reject or defer, unless required by a customer, regulator or top management	Steering committee

When an approved improvement changes the ISMS itself (processes, scope, roles), plan it through the ISMS change plan (DOC-ISMS-025, clause 6.3). When it supports an objective, link the objective ID in DOC-ISMS-024.

5. Fields and status

Field	Content
ID	CI-YYYY-NNN
Raised	Date and source code with reference
Description	The opportunity, in one or two sentences
Expected benefit	What will improve and how it will be measured
Benefit, Ease, Priority	Section 4 scores
Decision	Approve, Defer (with revisit date) or Reject (with reason), date and decided by
Owner and due	Accountable person and target date
Status	Proposed, Approved, InProgress, Done, Deferred, Rejected
Benefit review	After completion: was the expected benefit achieved, with evidence

6. Register

ID	Raised and source	Description	Expected benefit	B	E	P	Decision	Owner	Due	Status	Benefit review
CI-2027-001 (Example)	2027-01-28, STF	Shared vaults in the password manager for the support team instead of a shared document	Removes plain-text credentials (RISK-021)	2	3	6	Approve, ISMS manager, 2027-02-03	Head of Support	2027-02-28	Done	Achieved: shared document deleted 2027-02-20, 0 credentials found in the March scan
CI-2027-002 (Example)	2027-02-10, MEA	Automate the monthly MFA coverage metric from the identity provider	Saves about 2 hours a month, removes manual errors	2	2	4	Approve when capacity allows, steering committee, 2027-02-24	ISMS manager	2027-06-30	InProgress
CI-2027-003 (Example)	2027-02-18, THR	Phishing-resistant MFA for administrators after threat reports on MFA fatigue attacks	Reduces account takeover risk RISK-007 from High to Medium	3	2	6	Approve, steering committee, 2027-02-24	Head of Engineering Operations	2027-05-31	InProgress
CI-2027-004 (Example)	2027-03-02, CUS	Public trust centre page answering the most frequent questionnaire questions (DOC-ISMS-116)	Fewer questionnaire hours in sales	2	2	4	Defer to 2027-07-01, steering committee, 2027-03-10	Head of Sales		Deferred
CI-2027-005 (Example)	2027-03-10, STF (policy owners)	Align all policy reviews to one annual window in the ISMS calendar DOC-ISMS-032	One approval meeting a year instead of fourteen, simpler review tracking	2	3	6	Approve, ISMS manager, 2027-03-10	ISMS manager	2027-04-30	Done	Achieved: 14 of 14 policies on one review date
CI-2027-006 (Example)	2027-03-12, BEN	Replace the log platform with a full SIEM	Better correlation, but high cost for current volume	2	1	2	Reject, steering committee, 2027-03-24: cost not justified at current size; revisit at the 2028 budget	ISMS manager		Rejected
CI-2027-007 (Example)	2027-03-29, AUD (AF-2027-004)	Record a baseline value for every security objective	Progress visible at management review	2	3	6	Approve, ISMS manager, 2027-03-29	ISMS manager	2027-04-20	Done	Achieved: 6 of 6 objectives have baselines in DOC-ISMS-024
[CI-YYYY-NNN]	YYYY-MM-DD, [code]	[Description]	[Benefit and measure]	[n]	[n]	[n]	[Decision, by, date]	[@owner]	YYYY-MM-DD	[Status]	[Result and evidence]

7. Reporting to management review

Measure	Example: Quillmere Analytics Ltd at 2027-04-30, 7 entries
Entries by source	STF 2, MEA 1, THR 1, CUS 1, BEN 1, AUD 1 (no MR entries yet: the first management review is planned for April 2027)
Decisions	Approved 5, Deferred 1, Rejected 1
Status	Done 3, InProgress 2, Deferred 1, Rejected 1
Benefit achieved	3 of 3 done entries reviewed as achieved
Decisions needed	CI-2027-004 revisit on 2027-07-01

Check: 2 + 1 + 1 + 1 + 1 + 1 = 7 by source; 5 + 1 + 1 = 7 by decision; 3 + 2 + 1 + 1 = 7 by status.

8. Size tiers

Aspect	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large or multi-site: Quillmere Group (2,400 staff, 6 sites)
Channels	Steering committee, audit, incident reviews, a chat channel for suggestions	Adds hospital customer feedback, security team retrospectives, privacy team input ahead of the ISO/IEC 27701 extension	Adds site security coordinators, shared improvement pipeline with the ISO 9001 and ISO 22301 systems
Volume (Example)	10 to 25 entries a year	40 to 80 entries a year	Several hundred, with a site field and roll-up by theme
Decision forum	ISMS manager for priority 6 to 9 without budget; monthly steering committee otherwise	Security team weekly for small items; quarterly steering committee	Site level for local items; group security office and integrated management review for cross-site items
Benefit review	ISMS manager	Security team lead	Group security office, sampled by internal audit

9. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
Register and monthly snapshots	Improvements identified, decided and tracked	ISMS manager	Register tool, snapshots in the ISMS folder	Current certification cycle plus 3 years
Decision records (steering committee minutes)	Decisions taken by the right authority	Steering committee secretary	DOC-ISMS-007 minutes	Same
Benefit review evidence	Improvement achieved its purpose	Entry owner	Linked in the row	Same
Management review minutes	Improvement opportunities considered by top management	ISMS manager	DOC-ISMS-085	Same

10. References

Reference	Edition and status (as of November 2026)	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current; Amd 1 published 2024-02-23	Clauses 10.1, 9.3, 6.3
ISO/IEC 27003:2017	Current; a revision is in progress, check for a newer edition	Guidance on ISMS implementation and improvement
`isms/audit-findings-register`	DOC-ISMS-086	Source of OFIs, triage of nonconformities
`compliance/capa-nonconformity`	DOC-ISMS-087	Corrections and corrective actions
`compliance/management-review`	DOC-ISMS-085	Decisions on improvement
`isms/isms-change-plan`	DOC-ISMS-025	Planned changes to the ISMS
`compliance/objectives-register`	DOC-ISMS-024	Objectives linked to improvements

Official text (purchase or licensed access): ISO/IEC 27001 https://www.iso.org/standard/82875.html and Amd 1 https://www.iso.org/standard/88435.html; ISO/IEC 27003 https://www.iso.org/standard/63417.html.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 10.1 and 9.3. Sources, scoring rule, workflow and examples are original wording written for this template; no ISO or IEC text, tables or definitions are reproduced. Use the official standard, which is copyrighted and sold by ISO, IEC and national standards bodies. Check the current edition before use: ISO/IEC 27003 is under revision. Template licence: MIT.

Modèles associés

SMSI & ISO/IEC 27001