Key takeaways
- When something goes wrong, react, find the root cause, fix it, check it worked, and keep records.
- Fixing root causes prevents problems from recurring.
- Start here: react to nonconformities and contain consequences.
Purpose
When something goes wrong, react, find the root cause, fix it, check it worked, and keep records.
Requirement
Requirement summaryWhen a Nonconformity occurs, the organization shall: 1. React to the nonconformity, and as applicable: 1. take action to control and correct it; 2. deal with the consequences 2. evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by; 1. reviewing the nonconformity; 2. determining the causes of the nonconformity; and 3. determining if similar nonconformities exist, or could potentially occur 3. implement any action needed; 4. review the effectiveness of any corrective action taken; and 5. make changes to the information security management system, if necessary. Corrective actions shall be appropriate to the effects of the nonconformities encountered. Documented information shall be available as evidence of: 1. The nature of the nonconformities and any subsequent actions taken, 2. the results of any corrective action.
Why it matters
Fixing root causes prevents problems from recurring.
How to implement
- React to nonconformities and contain consequences.
- Analyse root causes and check for similar issues elsewhere.
- Implement corrective actions and verify effectiveness.
- Record nonconformities and actions.
What evidence you need to provide
Here is what you will typically need to provide for Clause 10.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your process for dealing with nonconformities (things not done as required) and corrective actions (fixes that stop them happening again).
Records and examples to show
- A log of nonconformities with the root cause, fix and owner.
- Proof fixes worked.
- Records showing you checked whether the same problem existed elsewhere.
Things you should be able to show or explain
- Be able to walk through one problem from discovery to fix.
How much to show: A handful of nonconformities.
Common mistakes
- Symptoms fixed but not the cause.
- Fixes never checked.
- Fixing symptoms only.
- Not checking whether fixes worked.
- Tip: Nonconformities aren't failures — they're proof your ISMS is learning.
Policies & documents to have
- Corrective action and continual improvement procedure
FAQ
Can we exclude clause 10.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
Root cause analysis and verified corrective actions.