Continual improvement

frameworkISO/IEC 27001:2022 sectionISMS clauses 4–10 csf 2.0ID.IM-01 ID.IM-02 ID.IM-03 RC.RP-06 topicsLessons Learned frameworks2 7 3

Official text · not licensableTitle: Continual improvement. The control text is ISO's copyright; see ISO/IEC 27001:2022.

gap from ISO 27001 → gap to ISO 27001 →

Wrong or missing mapping? Report it

Equivalents of Clause 10.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	ID.IM-03 RC.RP-06	Improvements are identified from execution of operational processes, procedures, and activities; The end of incident recovery is declared based on criteria, and incident-related documentation is completed	Editorial	Same topic: Lessons Learned (editorial pick)
CIS v8.1	CIS 17.8	Conduct Post-Incident Reviews	Editorial	Same topic: Lessons Learned (editorial pick)
SOC 2	CC7.5	Recovering from identified security incidents	Editorial	Same topic: Lessons Learned (editorial pick)
PCI DSS	12.10.6	Plan updated from lessons learned and industry changes	Editorial	Same topic: Lessons Learned (editorial pick) 2 loosely related (not mappings) 12.10.2 Incident response plan reviewed and tested annually Loosely related Only shares CSF ID.IM-02, RC.RP-06: related, not a mapping 10.5.1 Audit logs retained 12 months, three immediately available Loosely related Only shares CSF RC.RP-06: related, not a mapping
CMMC	IR.L2-3.6.1	Incident Handling	Editorial	Same topic: Lessons Learned (editorial pick)
800-53	IR-4 PM-1 PM-9 PM-31	Incident Handling; Information Security Program Plan…	Crosswalk	Same topic: Lessons Learned (editorial pick) NIST SP 800-53 → ISO 27001 mapping 1 loosely related (not mappings) IR-8 Incident Response Plan Loosely related Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.RP-06: related, not a mapping
HIPAA	§164.308(a)(6)§164.308(a)(6)(ii)	Security Incident Procedures; Response and Reporting	Loosely related	No mapping. Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, RC.RP-06: related, not a mapping
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	3.6 2.3	Post-incident reviews; Independent review of information and network security	Crosswalk	Same topic: Lessons Learned (editorial pick) ENISA NIS2 → ISO 27001 mapping
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.13(2)Art.13(3)	Learning and evolving; Learning and evolving	Editorial	Same topic: Lessons Learned (editorial pick)
CPS 234	Para 25	Response plans cover all stages and escalation	Editorial	Same topic: Lessons Learned (editorial pick)
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.