PDCA cycle

The PDCA cycle traces back to the statistician Walter A. Shewhart and was popularised by W. Edwards Deming as a model of continual improvement. It describes a control loop with four stages: "Plan" establishes the organisational context, interested parties, scope, risks and objectives and derives controls from them; "Do" introduces and operates the planned controls, policies and processes; "Check" uses metrics, internal audits and the management review to verify whether the controls are effective and the objectives are being met; "Act" corrects deviations, removes root causes and feeds improvements back into the next iteration. For an ISMS this loop is the actual engine. Without it, information security remains a one-off project; with it, it becomes a permanently managed process.

The cycle is deeply embedded in the standards, even though ISO/IEC 27001:2022 no longer prescribes the term PDCA explicitly. The harmonised structure shared by management system standards still follows it clearly: clauses 4 to 6 (context of the organisation, leadership, planning including risk assessment and risk treatment) form the Plan stage, clauses 7 and 8 (support, operation) the Do stage, clause 9 (performance evaluation with monitoring, measurement, internal audit and management review) the Check stage, and clause 10 (improvement, covering nonconformity and corrective action as well as continual improvement) the Act stage. The German BSI Standard 200-1 likewise describes the security process as a lifecycle of planning, implementation, effectiveness review and optimisation. Crucially, the cycle does not only run at the level of the ISMS as a whole: smaller loops apply per control, per security incident and per risk.

Supervisory law thinks in control loops too. Article 21 of the NIS2 Directive (EU) 2022/2555 requires an all-hazards, risk-based approach and, in paragraph 2(f), explicitly names policies and procedures to assess the effectiveness of cybersecurity risk-management measures — precisely the Check stage. The German transposition in the BSIG (NIS2UmsuCG) obliges the management body to approve the measures and to supervise their implementation; in practice the timetables for individual registration and evidence duties are still moving, so specific deadlines should always be checked against the current legal status. In day-to-day work the PDCA cycle rarely fails at Plan and Do, but at weak Check and Act stages: audits are carried out, yet findings are never closed out with a root-cause analysis and dated corrective actions. A robust cycle therefore needs named owners, a fixed cadence, measurable ISMS metrics and a documented feedback path into the next planning round.