ISO 27001 LI · Domain 6 of 7

ISO 27001 LI Domain 6: Continual Improvement of an ISMS Based on ISO/IEC 27001

The Act phase: finding root causes of nonconformities, treating them through correction and corrective action, building action plans, and keeping the ISMS improving as internal and external factors change.

Exam weight
7.5%
Official knowledge statements
6
Estimated questions estimate
~6
Suggested study time estimate
6–8 hrs

About 12 min read Reviewed October 2026

Overview

Domain 6 covers how an ISMS gets better over time. Its six knowledge statements are the processes and tools for identifying root causes, the treatment of nonconformities, developing corrective action plans, the concepts of continual improvement, continual monitoring of change factors, and maintaining and improving the ISMS.

The requirements sit in clause 10 of ISO/IEC 27001:2022, where 10.1 is continual improvement and 10.2 is nonconformity and corrective action, the reverse of the 2013 order. Change monitoring links back to clauses 4.1, 4.2, 6.3 and 9.3. This is one of the smaller domains, with 6 of the 80 questions, but its logic appears in scenarios across the exam.

How it's tested

Questions present a nonconformity or recurring problem and ask what to do first, which tool suits the analysis, whether a proposed plan is complete, or how a change in the environment should flow into the ISMS. Options often contrast a quick fix with a structured response that addresses causes.

  • First reaction

    After a nonconformity is found, you choose between controlling and correcting it, analysing causes or updating documentation, following the order in clause 10.2.

  • Pick the tool

    A problem with many contributing factors or a simple causal chain is described, and you select fishbone, five whys or Pareto analysis.

  • Improve or maintain

    A change in law, technology or business is described and you decide how the ISMS should respond through review, risk assessment or planned change.

Reasoning it through

Backup restores fail in three quarterly tests. Each time the operator re-ran the job and closed the ticket. The question asks the best next step. Re-running jobs is correction only. Clause 10.2 requires evaluating the need to eliminate causes, so perform root cause analysis, check whether similar failures exist elsewhere, implement corrective action and review its effectiveness at the next test.

Knowledge statements 6

Official knowledge statements from the PECB outline, in outline order.

6.1 The main processes, tools, and techniques used to identify the root causes of nonconformitiesFinding why a nonconformity occurred.
What it means
Root cause analysis looks beyond the symptom to the underlying reason a requirement was not met. Common tools are the five whys, the Ishikawa or fishbone diagram, Pareto analysis, fault tree analysis, and cause and effect matrices, supported by interviews and data review.
What to understand
Five whys suits simple linear problems. Fishbone organizes many possible causes into categories such as people, process, technology, environment and management. Pareto ranks causes by frequency to focus effort. Analysis should be evidence-based and involve the people who perform the process. Blaming human error is rarely a root cause in itself.
How it shows up
Expect questions asking which tool fits a described problem, such as many contributing factors across departments.
Common confusion
Accepting 'staff made a mistake' as the root cause.
6.2 The treatment of nonconformities processClause 10.2 steps for handling nonconformity.
What it means
When a nonconformity occurs, the organization reacts by taking action to control and correct it and dealing with consequences. It evaluates the need for action to eliminate causes by reviewing the nonconformity, determining its causes and checking whether similar ones exist or could occur. It implements needed action, reviews effectiveness and changes the ISMS if necessary.
What to understand
Documented information must be retained on the nature of nonconformities, actions taken and results of corrective action. Corrective actions must be appropriate to the effects of the nonconformity. Sources include audits, incidents, complaints, monitoring results and self-identified issues.
How it shows up
Questions ask which step comes after correction, or what documented information clause 10.2 requires.
Common confusion
Skipping the check for similar nonconformities elsewhere.
6.3 The main processes, tools, and techniques used to develop corrective action plansPlanning actions that prevent recurrence.
What it means
A corrective action plan records the nonconformity, the immediate correction, the root cause, the actions to remove it, responsible people, resources, deadlines and how effectiveness will be verified. Tools include action trackers, Gantt charts, responsibility matrices and SMART action definitions.
What to understand
Actions should address the root cause found, be proportionate, and be checked for side effects on other controls. Plans are approved by the responsible manager and monitored to closure. Effectiveness review happens after enough time has passed to show whether the problem recurs.
How it shows up
Expect a proposed plan and a question on what element is missing, often effectiveness review.
Common confusion
Closing an action as soon as it is implemented, before effectiveness is verified.
6.4 The main concepts related to continual improvementClause 10.1 and the improvement mindset.
What it means
Clause 10.1 requires the organization to continually improve the suitability, adequacy and effectiveness of the ISMS. Continual improvement is recurring activity to enhance performance, which may be incremental or occasionally a step change.
What to understand
Improvement inputs include audit results, measurement analysis, incidents, management review decisions, risk assessment updates and staff suggestions. Suitability asks whether the ISMS fits the organization, adequacy whether it is sufficient, and effectiveness whether it achieves intended results. Continual differs from continuous, which implies uninterrupted change.
How it shows up
Questions ask which three ISMS qualities clause 10.1 requires to be improved.
Common confusion
Thinking continual improvement applies only to effectiveness.
6.5 The processes related to the continual monitoring of change factorsWatching for internal and external changes that affect the ISMS.
What it means
Change factors include new laws and regulations, mergers, restructuring, new products, technology adoption, supplier changes, emerging threats and shifts in interested party expectations. The organization tracks them so that the ISMS stays aligned with its context.
What to understand
Monitoring feeds clause 4.1 and 4.2 reviews, risk reassessment when significant changes occur under 8.2, planned changes under 6.3 and management review inputs under 9.3.2. Sources include threat intelligence under Annex A 5.7, legal registers under 5.31 and change management under 8.32.
How it shows up
Expect scenarios where a new regulation appears and the question asks how the ISMS should respond.
Common confusion
Waiting for the next annual review before reassessing a significant change.
6.6 The maintenance and improvement of an ISMSKeeping the ISMS current and working after certification.
What it means
Maintenance keeps documents, risk assessments, controls, competence and records current. Improvement raises performance over time. Both depend on clear ownership, a calendar of recurring activities, and integration with business processes rather than a separate project.
What to understand
Typical recurring activities include policy reviews, access reviews, risk reassessment, awareness refreshers, supplier reviews, internal audits and management reviews. Loss of momentum after certification is a common risk, so maintenance should be resourced and measured like any other process.
How it shows up
Questions ask what best sustains an ISMS after the implementation project closes.
Common confusion
Treating the ISMS as finished once the certificate is issued.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Correction

    Action to eliminate a detected nonconformity.

    Remember
    Fixes the instance, not the cause.
    Tested as
    First-reaction items.
    Trap
    Treated as a full response.

  • Corrective action

    Action to eliminate the cause and prevent recurrence.

    Remember
    Follows root cause analysis.
    Tested as
    Plan quality items.
    Trap
    Confused with correction.

  • Five whys

    Repeatedly asking why to reach the underlying cause.

    Remember
    Best for simple linear problems.
    Tested as
    Tool selection.
    Trap
    Stopping at the first answer.

  • Ishikawa diagram

    Fishbone layout grouping possible causes into categories.

    Remember
    Useful when many factors may contribute.
    Tested as
    Tool selection.
    Trap
    Used to rank causes by frequency.

  • Pareto analysis

    Ranks causes by frequency or impact.

    Remember
    Roughly 80% of effects from 20% of causes.
    Tested as
    Prioritization items.
    Trap
    Used to find causes rather than prioritize them.

  • Effectiveness review

    Checking that corrective action prevented recurrence.

    Remember
    Required by clause 10.2 d.
    Tested as
    Plan completeness.
    Trap
    Closing actions at implementation.

  • Suitability, adequacy, effectiveness

    Three qualities clause 10.1 requires to improve.

    Remember
    Fit, sufficiency and results.
    Tested as
    Definition items.
    Trap
    Naming efficiency instead.

  • Change factor

    Internal or external change that may affect the ISMS.

    Remember
    Triggers context review and risk reassessment.
    Tested as
    Change scenarios.
    Trap
    Deferred to annual review.

  • Similar nonconformities

    Check whether the same issue exists or could occur elsewhere.

    Remember
    Part of clause 10.2 b.
    Tested as
    Process step items.
    Trap
    Fixing one location only.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Correction vs. corrective action vs. continual improvement

ConceptMeaningKey differenceCommon trap
Correction Fix the detected nonconformity, such as restoring a deleted log Immediate and local Mistaken for prevention
Corrective action Remove the cause, such as protecting logs from deletion Prevents recurrence Done without cause analysis
Continual improvement Ongoing enhancement of the ISMS Not limited to nonconformities Seen only as fixing problems

Root cause tools

ConceptMeaningKey differenceCommon trap
Five whys Iterative questioning Single causal chain Stops at a symptom
Fishbone Categorized cause brainstorming Many potential factors No evidence to confirm causes
Pareto Frequency ranking Prioritizes where to act Treated as a cause-finding tool

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Fix and close

    What candidates pick
    Correct the issue and close the nonconformity.
    Why it looks right
    The problem disappears quickly.
    Why it's wrong
    Clause 10.2 also requires evaluating causes, acting to prevent recurrence and reviewing effectiveness.

    Clue to watch for The same issue has occurred before.

  2. Retrain everyone

    What candidates pick
    Retrain staff as the corrective action.
    Why it looks right
    Training is a common reflex.
    Why it's wrong
    Without root cause analysis, retraining may not address a flawed process, tool or resourcing problem.

    Clue to watch for No cause analysis is mentioned.

  3. Pareto finds causes

    What candidates pick
    Use Pareto analysis to discover the root cause.
    Why it looks right
    It is a well-known quality tool.
    Why it's wrong
    Pareto prioritizes known causes by frequency; five whys or fishbone identify causes.

    Clue to watch for Question asks how to identify why something happened.

  4. Wait for review

    What candidates pick
    Note the new regulation for next year's management review.
    Why it looks right
    Management review covers changes.
    Why it's wrong
    Significant changes trigger risk reassessment and planned change when they occur, not only at the annual review.

    Clue to watch for Regulation takes effect soon.

  5. Improvement means efficiency

    What candidates pick
    Clause 10.1 requires improving efficiency, cost and speed.
    Why it looks right
    Business improvement often targets these.
    Why it's wrong
    Clause 10.1 names suitability, adequacy and effectiveness of the ISMS.

    Clue to watch for Question asks what the standard requires to improve.

Answer framework

For improvement questions, check that the response reacts, finds causes, acts, verifies and feeds lessons back into the ISMS.

  1. React first by controlling and correcting the nonconformity and dealing with any consequences, such as notifying affected parties.
  2. Review the nonconformity, collect evidence from records and the people involved, and use a suitable tool like five whys or fishbone to identify the root cause.
  3. Check whether similar nonconformities exist or could occur in other processes, sites or systems before designing actions, so the fix is not limited to one place.
  4. Plan corrective actions that address the root cause, with owners, resources, deadlines and a defined effectiveness check.
  5. Review effectiveness after a reasonable period, update the ISMS if needed, and record results as documented information for management review.

Practice question

An internal audit finds that firewall rule reviews were skipped for two quarters. The network team has now completed the overdue reviews and wants to close the finding. According to clause 10.2, what should happen next?

Want more like this? The ISO 27001 LI practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Read clause 10 of ISO/IEC 27001:2022 and note that 10.1 continual improvement now comes before 10.2 nonconformity and corrective action. Turn 10.2 into a five-step flowchart and keep it next to your exam materials, because most questions here follow that sequence.

Next, practise root cause analysis on three realistic problems: repeated phishing clicks, missed access reviews and failed backup restores. Use five whys on one, a fishbone on another and Pareto on incident data for the third. For each, write a corrective action plan with owner, deadline and effectiveness check, and ask whether the action would really stop recurrence.

Then map change factors. List ten possible changes, such as a new privacy law, a cloud migration or an acquisition, and trace how each flows into context review, risk reassessment, planned change and management review. Finally, sketch a yearly maintenance calendar for a certified ISMS. Practise in short sets of six questions and review the clause behind each answer.

FAQ

How many questions does Domain 6, Continual Improvement of an ISMS Based on ISO/IEC 27001, contribute?

The handbook allots 6 of the 80 questions, or 7.5% of the exam. Its reasoning about nonconformities also supports questions in other domains.

What is the difference between correction and corrective action?

Correction fixes the detected problem. Corrective action removes the cause so the problem does not recur, and its effectiveness must be reviewed.

Did clause 10 change in the 2022 edition?

Its subclauses were swapped: 10.1 is now continual improvement and 10.2 is nonconformity and corrective action. The requirements themselves are largely unchanged.

Is preventive action still in ISO/IEC 27001?

Not as a separate clause. Preventive thinking is built into risk-based planning under clause 6.1 and into checking whether similar nonconformities could occur under 10.2.

Which root cause tool should I choose on the exam?

Match the tool to the problem: five whys for a simple chain, fishbone for many possible factors, Pareto to rank known causes by frequency, and fault tree for complex technical failures.

Does continual improvement require constant change?

No. Continual means recurring improvement over time, not uninterrupted change. Improvements can be small and periodic, driven by audits, metrics, incidents and reviews.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

Test whether you can separate correction from corrective action, pick the right root cause tool and judge a corrective action plan.

Take the ISO 27001 LI practice test Check your ISO 27001 LI readiness

Keep going