PDCA

What is PDCA?

PDCA (Plan – Do – Check – Act) is a cyclical method for continuous improvement in which an organisation plans a change, carries it out, measures the effect and adjusts based on that result, after which the cycle starts again. The method is also known as the Deming cycle or Shewhart cycle and forms the backbone of quality management, information security and OT security. Management system standards such as ISO 9001, ISO 27001 and ISO 50001 are built around this principle, and IEC 62443 and the NIST CSF likewise assume a programme that keeps improving itself.

In industrial environments, PDCA helps to structurally improve cybersecurity controls, manage risks and demonstrably meet compliance requirements, without losing sight of process availability.

🧠 Where does the PDCA cycle come from?

The cycle goes back to physicist Walter Shewhart of Bell Telephone Laboratories. In his book Statistical Method from the Viewpoint of Quality Control (1939), he described production under statistical control as three steps: specification, production and inspection. He saw this as a scientific cycle of hypothesis, experiment and evaluation.

W. Edwards Deming adapted the cycle and took it to Japan in the early 1950s, where he lectured to managers and engineers. The Japanese participants condensed the idea into plan, do, check, act. Deming himself later preferred PDSA (Plan – Do – Study – Act): “study” better expresses that you analyse the results and learn from them, rather than merely ticking off whether something is correct. In Japanese quality thinking, PDCA became the engine of kaizen, small incremental improvements, and the cycle was later absorbed into improvement methods such as LEAN and Six Sigma, now used throughout industry worldwide.

🔧 What happens in each phase of PDCA?

📝 Plan

• Define objectives, policy, risks and controls - what do you want to achieve and how will you measure it?
• Carry out a risk assessment or Cybersecurity Risk Assessment and record the outcome in a risk register.
• Define roles (for example ISO, OSO and CISO) and processes.
• Align with standards such as IEC 62443 or ISO 27001, and set measurable KPIs.

🔧 Do

• Implement the planned measures, preferably on a small scale or on a single production line first.
• Configure industrial firewalls and access control.
• Roll out security awareness training.
• Set up SIEM, logging and patch management.
• Apply network segmentation or Zero Trust, always through change management.

🔍 Check

• Monitor, measure and evaluate effectiveness against the KPIs from the plan phase.
• Carry out audits and review logs via SIEM.
• Test the incident response plan with threat simulations.
• Verify that OT staff follow the policy in practice.

🔁 Act

• Correct deviations and find the real cause with a root cause analysis.
• Standardise what works: work instructions, baselines and policies are updated.
• Incorporate lessons learned from incidents, audits and evaluations, and start the next cycle.

Each completed cycle increases the maturity of the cybersecurity strategy and the control of OT risks.

🏭 How do you apply PDCA in an OT environment?

In industrial automation, PDCA works differently from office IT. A plant cannot stop for a test, changes often only fit into a maintenance shutdown, and a PLC or SCADA system sometimes runs for twenty years. The Do phase is therefore almost always small and controlled: first a test environment or a single line, and only then a full rollout.

Outside security, too, PDCA is everywhere on the factory floor. Quality departments use SPC in the check phase to spot process variation, and maintenance teams combine PDCA with TPM to reduce breakdowns structurally.

In OT, availability is crucial. PDCA helps tailor controls to operational reality in small, reversible steps.

🔐 Which standards and laws are based on PDCA?

PDCA is the common skeleton of virtually every management system. Since 2012, ISO standards have shared a fixed clause layout (Annex SL, now the harmonized structure), in which clauses 4 to 10 follow the cycle: context, leadership and planning (Plan), support and operation (Do), performance evaluation (Check) and improvement (Act). These security standards and laws all build on that logic:

An organisation holding several certificates can therefore run one shared PDCA cycle, for example in an integrated management system for quality, information security and energy.

🔄 What is the difference between PDCA, PDSA and DMAIC?

PDCA is the most general and fits at every level, from a single workstation to an entire security programme. DMAIC is an elaborated variant for one well-defined improvement project.

🛠️ What does an annual PDCA cycle for OT security look like?

A practical approach for a Dutch manufacturing or water organisation that falls under the Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026):

1. Plan (Q1) - update the asset inventory and the risk analysis per zone, choose three to five improvement goals and set KPIs, such as the percentage of critical systems with a current backup or the time taken to apply a critical patch.
2. Do (Q2–Q3) - implement the measures in phases, scheduled into maintenance shutdowns and recorded through change management.
3. Check (Q3–Q4) - measure the KPIs, have an internal audit carried out and exercise an OT incident scenario.
4. Act (Q4) - discuss the results in the management review, assign owners to corrective actions and include them in next year’s plan.

With an ISO 27001 certificate, this fits the fixed rhythm of the certification body: a certificate is valid for three years, with a surveillance audit every year. A maturity model shows whether each cycle actually delivers progress.

❓ Frequently asked questions

What do the letters PDCA stand for?

PDCA stands for Plan, Do, Check and Act: planning, carrying out, checking and adjusting. Together, the four steps form a cycle that is repeated again and again, so that an organisation improves step by step.

Is the PDCA cycle mandatory for ISO 27001?

Since the 2013 edition, ISO 27001 no longer names PDCA explicitly; the 2005 edition still described the cycle in so many words. The mandatory clauses on planning, operation, performance evaluation and improvement do follow PDCA logic, so a working ISMS always runs a PDCA cycle in practice.

How often should you run the PDCA cycle?

There is no fixed frequency for the PDCA cycle. For a management system an annual cycle with a management review is common, while improvement teams on the shop floor sometimes complete a small PDCA cycle every week.

What is the difference between PDCA and PDSA?

PDCA and PDSA describe the same cycle. Deming replaced “check” with “study” because he wanted to stress that you analyse the results and learn from them, instead of only checking whether the plan was carried out.

How does PDCA help with NIS2 and the Dutch Cybersecurity Act?

NIS2 and the Dutch Cyberbeveiligingswet require organisations not only to take measures but also to assess their effectiveness. A PDCA cycle makes that assessment and its follow-up demonstrable to the board and the supervisory authority.

Why is PDCA harder in OT than in IT?

In OT, a change can directly affect production and physical safety, and maintenance windows are scarce. That is why the Do phase of PDCA is kept smaller in OT, tested first and carefully scheduled, while the Check phase relies more on passive monitoring.

📌 In summary

PDCA is a proven method for continuous improvement in cybersecurity and industrial automation: plan, do, measure and adjust, and then start again. By running the cycle deliberately, OT organisations make security structural, measurable and adaptable, and meet ISO standards, IEC 62443 and the Dutch Cybersecurity Act.