ISO 27001 clause 10.2: Nonconformity and corrective action

What clause 10.2 requires in practice

Clause 10.2 describes what the organisation does when a requirement of its ISMS is not met. The first response is to react: take action to control and correct the problem, and deal with its consequences. The second is to judge whether further action is needed so the problem does not recur or appear elsewhere.

That second judgement has three parts: review the nonconformity, work out its causes, and look for similar problems that exist or could arise. Where action is needed, the organisation carries it out, then reviews whether it worked, and changes the ISMS itself if that is warranted. The action taken must fit the seriousness of the effects found.

Two outputs must be evidenced through documented information:

• the nature of each nonconformity and what was done afterwards;
• the results of any corrective action.

The clause does not name a root-cause technique, a form or a tool. Any approach is acceptable if it produces a defensible explanation and action that matches it.

Separate correction from addressing causes

Correction deals with the detected problem. Disabling an account that should already have been removed is a correction. Corrective action addresses why removal failed and helps prevent recurrence or occurrence elsewhere. Both may be necessary, but they answer different questions.

Review the nonconformity, determine its causes and consider whether similar issues exist or could arise elsewhere. Use evidence and a method proportionate to the issue. ISO 27001 does not prescribe a mandatory five-whys worksheet or another named root-cause tool. A method is useful only if it leads to a defensible explanation and action.

Choose action proportionate to the effects

Contain or control the issue and deal with relevant consequences. Identify the requirement that was not met and the evidence. Investigate process design, responsibility, resources, competence and interfaces as appropriate instead of immediately labelling the cause “human error”.

Evaluate what action is needed to address the causes and implement it. Check effectiveness after an appropriate opportunity to observe the result. A revised procedure or completed training session shows an activity happened; evidence from later work helps show whether the underlying problem was addressed.

Make ISMS changes where necessary. A local correction may be insufficient if the cause lies in shared governance or a common supplier process. Conversely, do not impose a complex company-wide programme for every isolated issue without considering its effects and cause.

Why corrective action discipline matters to the business

Every organisation has failures; what separates a trusted one is what it does next. A disciplined response limits the damage from the incident in hand and stops the same weakness resurfacing in another team, site or supplier. That protects customers, reduces repeat cost and avoids the embarrassment of the same finding appearing in successive assessments.

Assessors pay close attention here because it shows whether the management system genuinely learns. Closing records quickly without addressing causes, or blaming individuals without examining process design, tends to signal a system that records problems rather than resolving them. Sound handling turns findings from audits, incidents and reviews into lasting improvement and gives leadership an accurate picture of how well controls operate.

How to implement clause 10.2

Build a simple, consistent route from the first report of a problem to a verified closure, and keep it proportionate to the issue.

1. Agree where nonconformities can come from, such as internal audit, incidents, monitoring, supplier reviews and staff reports, and make sure each one enters the same route.
2. Assign an owner at once, contain the issue and deal with its consequences, noting who was affected.
3. Record which requirement was not met and what evidence shows it, so the finding is clear to someone who was not there.
4. Investigate causes in process design, responsibilities, resources and skills before settling on individual error, and check whether similar problems exist elsewhere.
5. Choose action matched to cause and impact, set an owner and a date that suits the task, and carry it out.
6. Return later, once the work has had a fair chance to run, and test whether the problem has stopped; record what you checked.
7. Change policies, processes or training in the ISMS where the cause was systemic, and report patterns to management review.

Illustrative examples

Retain a useful evidence trail

Common mistakes