Skip to main content
All measures

Measure · ISO 27001 and other standards

Address nonconformities and corrective actions

Take the existing finding from response through causes and correction to verified effectiveness.

Accountable: Finding owners with the people responsible for implementation and effectiveness reviewReviewed

Reuse existing records

Handbook chapter 10 defines the method. Use the existing finding, task or incident record; link related work and evidence rather than tracking the case in a second list.

What to do

  1. 1

    Record the nonconformity and response

    Describe which requirement was not met and what actually happened. Record the consequences and a responsible person in the existing record. Arrange necessary corrections and mitigate further consequences. If an incident is involved, link to its existing case record.

  2. 2

    Investigate causes and similar cases

    Examine the cause and whether similar nonconformities exist or could occur elsewhere. Decide appropriate corrective actions to address the cause and prevent recurrence or occurrence elsewhere. Keep the finding, reasoning and decision in the same record.

  3. 3

    Implement the correction and connect it to the finding

    Assign the agreed work and follow actual implementation. Link existing tasks or document the work directly at the finding. Take necessary ISMS changes through the existing change workflow. Completing a task alone does not demonstrate effective correction.

  4. 4

    Verify effectiveness and justify closure

    Set suitable criteria, timing and responsibility for checking effectiveness. Check the achieved state using appropriate evidence and evaluate the result. Retain the nature of the nonconformity, subsequent actions and the results of correction, including the effectiveness review, in the existing record. If the problem remains, continue the work. Close the record when the actual result justifies closure.

Worked example

An access review was marked complete

Fictitious example. A sample shows that unnecessary access remains active after the access review was marked complete. The team handles the case in the existing audit finding.

Response and cause
DecisionThe responsible person checks and corrects the affected access. Root-cause analysis shows that the previous task required confirmation but no check against actual permissions. Comparable reviews are included.
EvidenceFinding, mitigated consequences, evidenced cause and agreed corrective action in the same record.
Verified effectiveness
DecisionAfter the change, the responsible role checks actual permissions to see whether the revised workflow works. The result and any remaining work support the closure decision.
EvidenceLink to the change, actual review evidence and justified closure decision.

Record the result

  • Nature of the nonconformity, affected requirement, response and treatment of consequences.
  • Evaluated cause and similar or potential cases with agreed corrective actions.
  • Actual implementation, effectiveness review and results of correction, including necessary ISMS changes.

Common implementation mistakes

Only correct the visible error

Immediate correction may be necessary. Still examine causes and possible further cases before deciding an appropriate corrective action.

Treat task completion as effectiveness

An implementation update does not replace a check of the result. Record what was checked and why the achieved state justifies closure.

Related requirement

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 10.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The four steps connect response and consequences, causes and similar cases, suitable corrective actions, actual implementation, effectiveness review, necessary ISMS changes and retained details of the nonconformity and its results. The user must handle actual cases appropriately and verify effectiveness.

    Reference

Templates for your implementation

Related resources

Sources and further reading