The organization shall incorporate improvements derived from the monitoring, measurements, assessments, and lessons learned into protection process updates (continuous improvement).
The organization shall implement independent teams to assess the protection process(es).
Guidance
- Independent teams may include internal or external impartial personnel.
- Impartiality implies that assessors are free from any perceived or actual conflicts of interest regarding
the development, operation, or management of the organization's critical system under assessment
or to the determination of security control effectiveness.
The organization shall ensure that the security plan for its critical systems facilitates the
review, testing, and continual improvement of the security protection processes.
The organization shall continuously strive to improve the performance of the information security management system. Ways to improve are being actively sought - not just through audits or clear non-conformities.
Task owner is responsible for documenting the improvements made to the management system and dividing them into tasks to be performed, monitoring task execution and assessing the reached effects.
The knowledge gained from analyzing and resolving security incidents should be used to reduce the likelihood of future incidents and their impact.
The organization regularly analyzes incidents as a whole. This process examines the type, amount and cost of incidents with the aim of identifying recurrent and significant incidents that need more action.
If recurrent incidents requiring response are identified, based on them:
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
