ISO/IEC 42001:2023
Improvement – ISO/IEC 42001:2023

ISO/IEC 42001:2023 10.1: Continual improvement

Keep making the AIMS more suitable, adequate and effective.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 63 controls across 35 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
  • NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities

ISO 27002:2022 · 4 controls

  • 5.27 Learning from information security incidents
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security
  • 8.32 Change management

PCI DSS 4.0 · 4 controls

  • 11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis
  • 11.4.4 11.4.4 Correct exploitable findings from penetration tests
  • 12.1.2 12.1.2 Security policy reviewed annually and updated as needed
  • 12.10.6 12.10.6 Plan evolved from lessons learned and industry developments

SOC 2 · 4 controls

  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
  • SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)
  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
  • ISO-50001-10.2 Continual improvement
  • 10.1 Nonconformity and corrective action
  • 10.2 Continual improvement

ISO 14001:2015 · 2 controls

ISO 22000:2018 · 2 controls

  • 10.1 Nonconformity and corrective action
  • 10.2 Continual improvement

ISO 22301:2019 · 2 controls

  • 10.1 Nonconformity and corrective action
  • 10.2 Continual improvement

ISO 37001:2016 · 2 controls

  • 10.1 10.1 Nonconformity and corrective action
  • 10.2 10.2 Continual improvement
  • ISO-37002-10.2 Continual improvement
  • ISO37002-10.1 Continual Improvement
  • ISO-39001-10.2 Continual improvement
  • ISO39001-10.2 Continual Improvement
  • ISO-41001-10.2 Continual improvement
  • ISO41001-10.2 Continual Improvement

ISO 45001:2018 · 2 controls

ISO 55001:2014 · 2 controls

  • 10.1 Nonconformity and corrective action
  • 10.3 Continual improvement

ISO 56002 · 2 controls

  • ISO-56002-10.3 Continual improvement
  • ISO56002-10.2 Continual improvement

ISO 9001:2015 · 2 controls

ISO/IEC 27003:2017 · 2 controls

  • 27003-10.2 Continual Improvement
  • ISO27003-10.1 Nonconformity and corrective action

NIST SP 800-218 · 2 controls

  • AS9100D-10.3 Continual Improvement
  • SPC1-A.1 Continual Improvement
  • BS65000-10.1 Continual Improvement

ISO 10006:2003 · 1 control

  • 8.3 Continual improvement

ISO 14004:2016 · 1 control

  • 10.3 Continual improvement
  • ISO-22313-10.2 Continual improvement

ISO 22320:2018 · 1 control

  • ISO-22320-4.8 Continual improvement

ISO 27001:2022 · 1 control

  • 5.35 Independent review of information security

ISO 27005:2022 · 1 control

  • 10.8 Continual improvement

ISO 27701:2019 · 1 control

  • 5.8.2 Continual improvement

ISO 30401 · 1 control

  • ISO30401-10.2 Continual improvement

ISO 31000:2018 · 1 control

  • 4.h Continual improvement

ISO 37301:2021 · 1 control

  • 10.1 Continual improvement

ISO/IEC 23894:2023 · 1 control

  • ISO23894-4.8 Continual Improvement

ISO/IEC 27031:2011 · 1 control

  • 27031-10.1 Continual Improvement
  • ISO27557-10.1 Continual Improvement

ITIL 4 · 1 control

  • GM-CI-1 Continual Improvement

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Improvement – ISO/IEC 42001:2023

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 10.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

Query this from an agent

The graph holds this control, the 63 it maps to, and the evidence behind each claim, over MCP and REST.