ISO/IEC 27001 nonconformities: major, minor, and how to close them before they cost you the certificate

Major or minor: how an ISMS finding is graded

Accredited certification bodies for ISO/IEC 27001 work to ISO/IEC 17021-1, supplemented by ISO/IEC 27006-1 for information security. A nonconformity is a requirement not fulfilled: major if it affects the capability of the management system to achieve its intended results, minor if it does not.

Two situations can justify a major: significant doubt that effective process control is in place, and repeated minors on one requirement or issue that add up to a systemic failure. In an ISMS, majors tend to involve a risk process that has stopped, a key control declared but not operated, or one lapse repeated across teams. Opportunities for improvement are not nonconformities; they call for no formal response.

How an auditor writes an ISMS nonconformity

Each finding names a specific requirement, states the nonconformity clearly and details the objective evidence. The requirement may be a clause of ISO/IEC 27001, an Annex A control your Statement of Applicability declares applicable, or your own policy:

• Requirement: Annex A 5.18, Access rights, and the policy's quarterly review of administrator accounts.
• Evidence: no review of the production cloud platform for three quarters; one of eleven administrator accounts sampled belonged to an engineer who left four months earlier.
• Statement: the organisation could not demonstrate that privileged access to production is reviewed as its policy requires.

Each finding is discussed with you to confirm the evidence is accurate and understood, so produce any missed record then. Auditors refrain from suggesting causes or fixes, and disputes go to the body's documented appeals process.

Clause 10.2 in practice: correction, cause and corrective action

ISO/IEC 27001 clause 10.2, Nonconformity and corrective action, applies however a nonconformity was found. For the access finding above:

Correction: contain the instance

Disable the leaver's account, check the logs for use after the leaving date, handling any as an incident, and complete the overdue review.

Root cause: why the control failed

The review lived in one administrator's calendar, and HR's leaver notice never reached the cloud team. Clause 10.2 also wants to know whether similar nonconformities exist or could arise: here, any system that grants access outside the central directory.

Corrective action: change the process

Route leaver notices to every in-scope system owner and make each review a tracked task with a deputy; after two cycles, confirm none ran late and no leaver kept access. Disabling one account is only the correction, and a plan that stops there leaves the next leaver's access to chance. Keep the action proportionate to the effects, as the clause requires.

Eight real-world ISMS nonconformities and their fixes

Each row is a composite from ISMS audits, not an extract from any report, and grades assume an isolated case. Clause 7.3 requires awareness, not a record: the record auditors ask for is usually one your own procedure promises.

Deadlines, verification and closure evidence

The audit team states the timeframe for your plan for correction and corrective action at the closing meeting; the certification body sets it, so confirm it in writing. Your response analyses the cause and describes the correction and corrective action taken or planned. The body reviews it, verifies effectiveness and says whether it needs an additional full audit, an additional limited audit or documented evidence confirmed at a later audit.

Closure evidence shows the control working since the audit, not a promise:

• system records dated after the audit, such as the signed-off access review, the restore log or the approved change ticket;
• the revised policy or procedure, with its new version and approval;
• the first cycle run under it, such as a countersigned supplier schedule;
• for effectiveness, a run of results, such as two review cycles on time.

When a major stays open: three points in the cycle

Before the first certificate

No certification decision is possible with a major open, and if verifying its correction and corrective action takes longer than six months from the last day of Stage 2, the body must repeat Stage 2 before recommending certification.

During the certificate's life

Failing to meet certification requirements can lead the body to suspend certification; while suspended it is temporarily invalid, so it cannot be cited in a security questionnaire. Unresolved, suspension ends in withdrawal or a reduced scope.

At the recertification audit

Majors raised at recertification must be verified before expiry, or certification is not extended. If it lapses, the body may restore it within six months, provided the outstanding recertification activities are finished; any later and at least a Stage 2 is required. The surveillance and recertification guide covers the full cycle.

How to avoid the common ISMS findings

Five of the eight findings above involve records that exist only when a control runs on schedule, and none can be produced the week before Stage 2. Start those controls early and let your internal audit sample them against the Statement of Applicability as well as the clauses. Stage 1, the certification body's readiness review, records areas of concern that could become Stage 2 nonconformities; the Stage 1 and Stage 2 guide explains both audits, and ten recurring audit failures are in the common mistakes guide.

ISO/IEC 27001 nonconformities: questions buyers ask