Where is your Continual Improvement policy template?

Please note that ISO 27001 does not prescribe any specific documentation for clause 10.1 Continual Improvement.

Our ISO 27001 Documentation Toolkit covers all mandatory documents and some documents that are not mandatory. A Continual Improvement policy do not need to be documented according to the standard, and in our opinion it would be an overhead to document it in a small company. 

Our toolkit is created specifically for smaller companies that want to implement ISO 27001 in a quick way, without unnecessary paperwork; for larger companies that require more documents we recommend getting some other solution.

This article will also help you: List of mandatory documents required by ISO 27001 (2013 revision)

Commitment to continual improvement is defined in the Information Security Policy, which can be found in folder 05 General Policies.

Examples of how you can demonstrate continual improvement are:

• decrease in the number of incidents and losses due to security incidents
• changes in the ISMS to correct problems or take advantage of opportunities identified during the management review

These articles will provide you with further explanation about continual improvement:
- Why is management review important for ISO 27001 and ISO 22301?
- Achieving continual improvement through the use of maturity models