COR-4 - Continuous Improvement and Corrective Actions
Control for the systematic management of findings, incidents and improvement opportunities
Control Definition
Corrective and preventive actions arising from audits, incidents and risk assessments must be formally managed, immediately containing each non-conformity and analyzing its root cause to define a remediation plan with an owner and a date. The effectiveness of the implemented actions must be validated, they must be prioritized according to their risk, and a continuous improvement cycle must be applied that includes periodic management reviews of the management system's performance. The results of these reviews must be communicated to stakeholders, incorporated into the cybersecurity roadmap, and the lessons learned must be documented.
Requirements
Requirement 1
We implement a formal corrective and preventive action management process for all findings from audits, incidents and risk assessments, responding immediately to control and correct each non-conformity.
Requirement 2
We define a remediation plan with an owner and a date for each identified corrective action.
Requirement 3
We prioritize corrective actions according to the associated risk level.
Requirement 4
We implement a PDCA (Plan-Do-Check-Act) cycle for the systematic management of findings, incidents and improvement opportunities.
Requirement 5
We plan actions to manage risks and seize opportunities in order to achieve continuous improvement.
Requirement 6
We respond to any non-conformity by managing the consequences it has caused.
Requirement 7
We perform root cause analysis using a methodology, for example: 5 Whys, the Ishikawa diagram, among others...
Requirement 8
We record all corrective and preventive actions in the tracking system.
Requirement 9
We validate the effectiveness of the implemented solutions before closing corrective actions.
Requirement 10
We communicate the results of management reviews to the relevant stakeholders.
Requirement 11
We incorporate the results of management reviews into the cybersecurity roadmap.
Requirement 12
We document the lessons learned from the findings, incidents and improvement opportunities managed.
Requirement 13
We include in the management review the follow-up of actions left pending from previous reviews.
Requirement 14
We include in the management review changes in the external and internal environment that may affect the management system.
Requirement 15
We include in the management review changes in what interested parties need or expect.
Requirement 16
We include in the management review the feedback and opinions received from interested parties.
Requirement 17
We include in the management review the opportunities identified to keep improving the management system.
Requirement 18
We include in the management review outputs the decisions made on how to continually improve the management system.
Requirement 19
We include in the management review outputs any change deemed necessary to the management system.
Requirement 20
We check whether there are other similar non-conformities that also require corrective actions.
Requirement 21
We update the management system when needed as a result of the corrective actions applied.