ISO 27001 Clause 10.2: Nonconformity and corrective action

What is ISO 27001 Clause 10.2?

Clause 10.2 requires organisations to respond to nonconformities in a structured, documented way: identifying what went wrong, why it went wrong, fixing it, and proving it won't happen again. It sits inside Clause 10 (Improvement), which means its purpose is not just remediation. It is the mechanism through which your information security management system (ISMS) gets stronger over time.

An empty nonconformity log does not mean your ISMS is working. It means nothing is being recorded. Auditors know this, and it is one of the first things they check.

What a nonconformity actually means

A nonconformity occurs when a requirement is not met. That requirement can come from two places:

• The standard itself: a clause of ISO 27001 that your ISMS fails to satisfy
• Your own documented procedures: a process you defined that wasn't followed

Both count. If your access review procedure requires quarterly reviews and they ran eight months late, that is a nonconformity, even if the standard doesn't specify a frequency. You set the bar; you missed it.

The CAPA (corrective and preventive action) process is triggered by corrective actions arising from nonconformities, observations, and opportunities for improvement identified through:

• Internal or external audits
• KPI measurement
• Management review
• Other monitoring and review activities

Severity levels

• Major: a significant failure or complete absence of a requirement. The ISMS cannot be considered effective in this area and typically must be fixed within 3 months. Certification is at risk if left unresolved.
• Minor: an isolated lapse or partial gap. The process exists but slipped or has a small weakness and typically must be fixed within 12 months, but a corrective action plan must be approved by the auditor.
• Observation: not a failure, but a weakness or risk that could become a nonconformity if left unaddressed. No immediate action required but worth monitoring and logging.
• Opportunity for Improvement (OFI): a suggestion for doing something better, even where current practice meets the requirement. No corrective action needed; feeds into continual improvement.
• Conformity: the requirement is met and evidence supports it.

Correction vs. corrective action

This is the most commonly confused point in Clause 10.2, and getting it wrong is one of the main reasons auditors push back on CAPA entries.

A correction without a corrective action tells an auditor you dealt with the symptom but left the cause intact. They will raise it again at the next audit, because the same problem will resurface.

Root cause analysis

Before you can write a corrective action, you need to know why the nonconformity happened. Not the surface reason, the underlying cause.

The simplest tool: 5 Whys. Ask why repeatedly until you reach something actionable.

Example:

Finding: Supplier security assessments were not completed before onboarding three new vendors.

Why? → The procurement team didn't complete them. Why? → They weren't aware it was required before onboarding. Why? → The supplier assessment procedure wasn't included in procurement onboarding.

Root cause: Process ownership gap, procurement not included in ISMS procedure communication.

That root cause gives you something real to fix. "Remind procurement to do assessments" is a correction. "Add supplier assessment requirements to procurement onboarding and assign a named owner" is a corrective action.

What the standard requires

When a nonconformity occurs, the process is:

1. React: control and correct it; deal with any immediate consequences
2. Investigate: determine the root cause; check whether similar nonconformities exist or could occur elsewhere
3. Act: implement the corrective action needed
4. Review: verify that the corrective action was effective
5. Update: make changes to the ISMS if required; feed findings into management review

Corrective actions must be proportionate to the nonconformity. A minor procedural lapse does not require a full ISMS overhaul. A systemic control failure might.

What you must document

Two records are explicitly required.

• The nature of the nonconformity and any actions taken
• The results of the corrective action: evidence that it worked

In practice this means maintaining a Nonconformity and Corrective Action Log: a central register that tracks every finding from detection through to verified closure. An auditor will ask to see it. If it is empty, sparse, or full of entries marked closed with no evidence, expect findings.

What a complete CAPA entry contains:

• Description of the nonconformity and its severity
• Root cause (output of RCA, not the symptom)
• Correction taken and date completed
• Corrective action, named owner, and due date
• Status: Open / In Progress / Closed
• Closure evidence: what proves it is done and effective

What auditors look for

Three things consistently get raised during audits.

Shallow root cause

"Human error" is not a root cause. It is a symptom. Push further: what process, training, ownership, or system gap allowed human error to occur?

No closure evidence

Marking a CAPA closed without evidence is the same as not closing it. Evidence means something verifiable: an updated procedure, a training record, a screenshot of a completed review, a re-test result.

Stale entries

Corrective actions sitting open with no activity signal that the ISMS is not being actively managed. Every open entry should have a current owner and a realistic due date.

How Clause 10.2 feeds back into the ISMS

Nonconformities do not live in isolation. They are a mandatory input to Clause 9.3 management review: leadership must be sighted on open findings, patterns, and whether corrective actions are effective. They also feed back into Clause 6 risk assessment: a recurring nonconformity may indicate a risk that was underestimated or a control that is not working as designed.

A well-run CAPA process does not just close findings. It improves the ISMS, which is the entire point of Clause 10.

What's next?

Corrective actions are one of the four workstreams that keep an ISMS running. ISO 27001 Clause 8: putting the plan into action shows how to manage them alongside your operational plan and risk treatment.

Some nonconformities start as incidents. Incident Management: Building a Process You'll Actually Follow covers how to handle one so the lessons reach your corrective action log.