AMC1 IS.AR.235(b) Continuous improvement

• ED Decision 2023/010/R found in: Information Security (2023/203 and 2022/1645) Part-IS (Jun 2024)

AMC1 IS.AR.235(b) Continuous improvement ED Decision 2023/010/R When a deficiency is identified, the competent authority should react in a timely manner following a defined process leading to a managed status regarding the deficiency, its associated consequences and, if needed, the prevention of its future recurrence or occurrence elsewhere. Based on an evaluation of the impact and extent of the deficiency and the potential consequences on the ISMS, the process should include as criteria for compliance: (a)     deciding on corrections and their implementation without undue delay in order to limit the impact of the deficiency and deal with its consequences as well as, as applicable, to control or eliminate it; (b)     deciding on the need for, and the implementation of, corrective actions to eliminate the cause(s) of, and contributing factors to, the deficiency based on a root cause analysis and an evaluation of actions remediating the cause aimed at being proportionate to the consequences and impact of the deficiency; (c)      verifying the implemented actions: (1)     to be effective and to result in acceptable residual risks; (2)     not to have unintended side effects leading to other deficiencies, new risks, or an ISMS not aligned with the applicable requirements; as well as (3)     for corrective actions, to effectively remediate or eliminate the root cause; (d)     reporting to and reviewing the identified deficiencies, action plan and results of the action taken with the person identified in [IS.AR.225](#_DxCrossRefBm1193569459)(a) and, as necessary, with other involved or affected roles and parties; (e)     documenting as evidence the detected deficiencies, the planned and implemented corrections and/or corrective actions with deadlines and responsible persons, the management feedback, the outcomes of the process step under point (c) above and, if necessary, the change decisions made for the ISMS itself. ##### AMC1 IS.AR.235(b) Continuous improvement *ED Decision 2023/010/R* When a deficiency is identified, the competent authority should react in a timely manner following a defined process leading to a managed status regarding the deficiency, its associated consequences and, if needed, the prevention of its future recurrence or occurrence elsewhere. Based on an evaluation of the impact and extent of the deficiency and the potential consequences on the ISMS, the process should include as criteria for compliance: (a) deciding on corrections and their implementation without undue delay in order to limit the impact of the deficiency and deal with its consequences as well as, as applicable, to control or eliminate it; (b) deciding on the need for, and the implementation of, corrective actions to eliminate the cause(s) of, and contributing factors to, the deficiency based on a root cause analysis and an evaluation of actions remediating the cause aimed at being proportionate to the consequences and impact of the deficiency; (c) verifying the implemented actions: (1) to be effective and to result in acceptable residual risks; (2) not to have unintended side effects leading to other deficiencies, new risks, or an ISMS not aligned with the applicable requirements; as well as (3) for corrective actions, to effectively remediate or eliminate the root cause; (d) reporting to and reviewing the identified deficiencies, action plan and results of the action taken with the person identified in [IS.AR.225](#_DxCrossRefBm1749084193)(a) and, as necessary, with other involved or affected roles and parties; (e) documenting as evidence the detected deficiencies, the planned and implemented corrections and/or corrective actions with deadlines and responsible persons, the management feedback, the outcomes of the process step under point (c) above and, if necessary, the change decisions made for the ISMS itself.