Sub-clauses
- 10.1 Continual improvement
- 10.2 Nonconformity and corrective action
Why it matters
Shows the ISMS can catch and fix its own problems. The same nonconformity recurring twice is a bigger finding to an auditor than the first one ever was.
What it requires
A process for logging nonconformities, taking corrective action, and evidence you're continually improving rather than just maintaining a static system.
How a self-led small team handles it
Don't be afraid to log real nonconformities. An ISMS with a few honestly-tracked nonconformities and real fixes looks more credible at audit than one that claims perfection.
Track Clause 10 directly — itsbestpractice has a dedicated Nonconformities section built around exactly this clause.
Start your ISMS