The PDCA Cycle Explained for Managers

Plan-Do-Check-Act sounds bureaucratic. In practice it means: write down what you do, do it, check whether it works, adjust accordingly. Here's the shortest useful explanation.

PDCA is the backbone of every ISMS. ISO 27001 expects you to apply this cycle. In practice it operates on three levels: strategic (yearly), tactical (quarterly), operational (continuous).

Strategic: annually

\n
• Plan: annual plan with 2–5 security objectives.
\n
• Do: execution throughout the year.
\n
• Check: internal audit + management review.
\n
• Act: findings feed into the next annual plan.
\n

Tactical: quarterly cadence

\n
• Plan: which controls need attention this period?
\n
• Do: access reviews, backup tests, policy updates.
\n
• Check: collect findings, update the risk register.
\n
• Act: schedule corrective measures.
\n

Operational: continuous

Log incidents, run phishing simulations, perform vulnerability scans, apply patches. Every week there is something to address.

One common rule

Record all cycles (yearly, quarterly, weekly) in the same calendar or tool. An ISMS that lives only in people's heads is an ISMS that won't survive its first busy audit period.

See also what is an ISMS.