ISMS update and improvement" phase
ISO 27001: Information Security Management Systems

Improvement (clause 10.1)

Improvement records are included in Corrective Action Forms (CAFs). However, it is much better to include such records in an application that is already used by the organization's Help Desk, because corrective actions are nothing more than to-do lists with clearly defined responsibilities, tasks and deadlines. The terms "preventive action" and "corrective action" have disappeared in the 2013 version. These actions still exist, even if they are not defined. Preventive actions: eliminate the causes of a non-conformity, whether or not it has already occurred. Corrective actions: limit the effects of non-conformities.

Guiding principles for improvement

The value

Customer requirements are fulfilled by the service...