{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/pdca","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/pdca/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/pdca/"},"term":{"en":"Continuous improvement (PDCA)","da":"Kontinuerlig forbedring (PDCA)"},"aka":{"en":["PDCA","Plan-Do-Check-Act","Deming cycle","continual improvement"],"da":["PDCA","Plan-Do-Check-Act","Deming-cirklen","løbende forbedring"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":1950,"summary":{"en":"A repeating four-step loop - Plan, Do, Check, Act - for getting a little better each round.","da":"En gentagen firetrins-cyklus - Plan, Do, Check, Act - for at blive lidt bedre for hver runde."},"body":{"formal":{"en":"A repeating management method, made widely known by W. Edwards Deming, in which changes are planned from goals and risks, carried out, measured against those goals, and the lessons acted on before the next round begins.","da":"En gentagen ledelsesmetode, gjort kendt af W. Edwards Deming, hvor ændringer planlægges ud fra mål og risici, gennemføres og måles mod målene, hvorefter man handler på erfaringerne, før næste runde begynder."},"plain":{"en":"Like a cook perfecting a dish - make it, taste it, adjust the seasoning, and cook it again next week a little better.","da":"Som en kok, der finpudser en ret - lav den, smag på den, juster krydderierne og lav den lidt bedre igen i næste uge."},"inPractice":{"en":"The IT lead at a Danish upper-secondary school plans a phishing course for teachers, runs it, sees the click rate fall in every subject group but one, and changes the format for that group next term.","da":"Den IT-ansvarlige på et dansk gymnasium planlægger et phishing-kursus for lærerne, gennemfører det, ser klikraten falde i alle faggrupper undtagen én og ændrer formen for den gruppe næste semester."},"whyItMatters":{"en":"Threats and organisations keep changing, so security work is never finished; without a built-in loop, measures that fitted last year quietly stop fitting.","da":"Trusler og organisationer ændrer sig hele tiden, så sikkerhedsarbejdet bliver aldrig færdigt; uden en fast cyklus holder tiltag, der passede sidste år, stille og roligt op med at passe."}},"deepDive":{"en":"The cycle descends from Walter Shewhart's 1939 description of quality control as a loop of specification, production and inspection. W. Edwards Deming presented a version of it in his 1950 lectures to Japanese engineers and managers, and Japanese practitioners recast it as Plan-Do-Check-Act. Deming himself called it the Shewhart cycle and later argued for Plan-Do-Study-Act (PDSA), because \"check\" suggests inspection while \"study\" implies analysing results against a prediction. Both forms remain in use, and neither is tied to information security.\n\nIn security management the cycle became explicit through ISO/IEC 27001:2005, whose introduction presented the ISMS as a PDCA model. The 2013 edition removed that section when it adopted the common structure for ISO management system standards and no longer prescribed a particular improvement model, but the loop is still built into the clause order of the 2022 edition: Plan corresponds to clauses 4-7 (context, leadership, planning including risk assessment and treatment, support), Do to clause 8 (operation), Check to clause 9 (monitoring and measurement, internal audit, management review) and Act to clause 10 (improvement). In the 2022 edition clause 10.1 is continual improvement and 10.2 nonconformity and corrective action, the reverse of the 2013 order.\n\nISO uses \"continual\" rather than \"continuous\" deliberately: improvement happens in recurring steps, not as an unbroken flow. ISO/IEC 27000 also separates a correction, which fixes a detected nonconformity, from a corrective action, which removes its cause to prevent recurrence; an audit finding closed with only a correction leaves the Act step incomplete. Evidence an auditor expects includes a nonconformity log with root-cause analysis, follow-up on effectiveness and management review outputs that change something.\n\nThe typical failure is a loop that turns but does not steer: Check degenerates into verifying that documents exist, and Act never feeds back into the next Plan, so the same findings reappear every year. Another is running a single annual loop for everything, when threats move faster than that. Mature organisations nest loops at different speeds, for example weekly for vulnerability management, after every incident as lessons learned, and yearly for the risk assessment and management review. Related loops such as the OODA loop (observe, orient, decide, act) in incident response or lessons-learned phases in NIST incident handling guidance serve the same purpose at operational speed, while PDCA remains the governance-level rhythm.","da":"Cyklussen stammer fra Walter Shewharts beskrivelse fra 1939 af kvalitetskontrol som en løkke af specifikation, produktion og inspektion. W. Edwards Deming præsenterede en udgave af den i sine forelæsninger for japanske ingeniører og ledere i 1950, og japanske praktikere omformede den til Plan-Do-Check-Act. Deming kaldte den selv Shewhart-cyklussen og argumenterede senere for Plan-Do-Study-Act (PDSA), fordi \"check\" leder tanken hen på inspektion, mens \"study\" indebærer, at man analyserer resultaterne mod en forudsigelse. Begge former bruges stadig, og ingen af dem er knyttet specifikt til informationssikkerhed.\n\nInden for sikkerhedsstyring blev cyklussen eksplicit med ISO/IEC 27001:2005, hvis indledning præsenterede ISMS'et som en PDCA-model. 2013-udgaven fjernede det afsnit, da den gik over til den fælles struktur for ISO's ledelsessystemstandarder, og foreskrev ikke længere en bestemt forbedringsmodel, men løkken er stadig bygget ind i afsnittenes rækkefølge i 2022-udgaven: Plan svarer til afsnit 4-7 (kontekst, ledelse, planlægning inklusive risikovurdering og -håndtering, støtte), Do til afsnit 8 (drift), Check til afsnit 9 (overvågning og måling, intern audit, ledelsens evaluering) og Act til afsnit 10 (forbedring). I 2022-udgaven er 10.1 løbende forbedring og 10.2 afvigelser og korrigerende handlinger, den omvendte rækkefølge af 2013-udgaven.\n\nISO skriver bevidst \"continual\" og ikke \"continuous\": forbedringen sker i tilbagevendende trin, ikke som en ubrudt strøm. ISO/IEC 27000 skelner også mellem en korrektion, der retter en konstateret afvigelse, og en korrigerende handling, der fjerner årsagen, så afvigelsen ikke gentager sig; et auditfund, der kun lukkes med en korrektion, efterlader Act-trinnet ufuldendt. Den dokumentation, en auditor forventer, omfatter en afvigelseslog med årsagsanalyse, opfølgning på, om handlingerne virkede, og resultater fra ledelsens evaluering, der rent faktisk ændrer noget.\n\nDen typiske fejl er en løkke, der drejer rundt uden at styre: Check skrumper til at kontrollere, at dokumenterne findes, og Act føder aldrig tilbage til næste Plan, så de samme fund dukker op hvert år. En anden er at køre én årlig løkke for alt, når truslerne bevæger sig hurtigere. Modne organisationer lægger løkker med forskellig hastighed inden i hinanden, fx ugentligt for sårbarhedsstyring, efter hver hændelse som erfaringsopsamling og årligt for risikovurdering og ledelsens evaluering. Beslægtede løkker som OODA-løkken (observe, orient, decide, act) i hændelseshåndtering eller erfaringsfasen i NIST's vejledning om hændelseshåndtering tjener samme formål i driftstempo, mens PDCA forbliver rytmen på styringsniveau."},"edges":[{"type":"used-with","to":"security/risk-management","why":{"en":"Risks are reassessed each round, and the results steer the next Plan step.","da":"Risici vurderes igen i hver runde, og resultatet styrer det næste Plan-trin."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-policy","confidence":"medium","strength":"minor"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27001:2022, Clause 10 (Improvement)","tier":"standard","publisher":"ISO/IEC"}],"draft":true}