ISO 27001 nonconformities: major vs minor and corrective action

What happens when an ISO 27001 auditor raises a nonconformity

A nonconformity is the non-fulfilment of a requirement, and a major nonconformity is one that affects the management system's ability to achieve its intended results. If an auditor raises a major, the certification body cannot recommend certification until it has verified the corrections and corrective actions. Under the ISO/IEC 17021-1 rule summarized in European Accreditation FAQ 36.14, that verification must happen within 6 months after the last day of stage 2. If it does not, the certification body must conduct another stage 2 before it can recommend certification. Confirm the exact date of your last stage 2 day with your certification body, because that date starts the clock.

The grade depends on what the auditor found and what the evidence shows, not on how hard the team worked. A policy that exists but was never applied, or a risk treatment that does not trace to the Statement of Applicability, can be graded as a major even when the people involved were diligent. Your organization owns the root cause analysis and the corrective action under clause 10.2 of ISO/IEC 27001:2022, so it is your team that must find out why the gap happened and show that the fix works. An implementation partner can help prepare the records, but the partner does not decide the grade. Only the certification body decides the grade and whether certification is granted.

Start with a written list of every finding, its grade and the evidence you will submit against it. For each major, record the root cause, the corrective action, the owner and the date the change took effect, then collect objective evidence that the control operated afterward, not only that the document was revised. Ask your certification body in writing which evidence it expects for each finding, and whether it will verify corrections remotely or on site. Plan for a second stage 2 if the verification window is at risk, because the certification body is entitled to repeat that step.

How major and minor findings differ under ISO/IEC 17021-1

Certification auditors sort ISO 27001 findings by how much they threaten the management system's ability to deliver its intended results. The cards below separate the definitions, the practical test auditors apply, and the observations that sit outside the grading. The certification body makes the final grade, so the organization's job is to understand the test and prepare evidence before the audit.

What a nonconformity is

Under ISO/IEC 17021-1, a nonconformity is the non-fulfilment of a requirement. The requirement can come from the ISO 27001 clauses 4 to 10 or from the controls the organization has chosen in its Statement of Applicability. Auditors write a finding whenever they can show a requirement was not met, so the first check is whether each requirement has a documented, working process with records behind it. A finding is a gap between what the standard requires and what the audit evidence shows, not a judgment about overall security quality.

What a major nonconformity is

A major nonconformity is one that affects the capability of the management system to achieve its intended results. The definition in ISO/IEC 17021-1 turns on effect, not on how many requirements were missed. Examples an assessor might weigh include a risk assessment that was never performed, or internal audits and management reviews that never happened, because the system cannot then show it works. Whether a gap is major is the certification body's decision, so the organization should ask the auditor for the reasoning behind each grade.

The practical test: effect on results

When an auditor grades a finding, the working question is whether the gap stops the ISMS from delivering its intended results, such as managed information security risks and controlled access to information. A single missed record in an otherwise working process is usually weighed differently from a process that does not exist or runs nowhere. Teams preparing for audit should trace each Statement of Applicability control to a live procedure and a dated record, because a gap in one area that repeats across the system is more likely to be read as a systemic failure.

Observations and opportunities for improvement

Auditors may point out opportunities for improvement under clause 5.2.2 of ISO/IEC 27006-1, as cited in European Accreditation FAQ 49.4. These are not nonconformities and do not carry a corrective action deadline. The same clause allows an auditor to flag an area for improvement but bars recommending a specific solution, so the organization still chooses how to respond. Treat observations as input to the next management review and to the improvement process in clause 10.1 rather than as a scorecard item.

Who decides the grade

The certification body decides whether each finding is a nonconformity, a major nonconformity or an observation. Neither the implementation partner nor a consultant can issue or downgrade a grade, because only the independent certification body can make that call. Consultants can prepare records and explain the requirement, but they should not promise a result. Before stage 2, ask the certification body how it records and reports findings so the organization can plan responses against its own written process.

How a finding moves from audit day to closure

The sequence turns each finding into a recorded, verified correction so the certification body can decide whether the organization's management system is fit to certify. Each step produces a document or decision that the next step relies on.

Record the finding with its requirement and evidence
The auditor writes each finding on the audit record and states the requirement it fails, whether that is a clause of ISO/IEC 27001:2022 or an Annex A control, along with the objective evidence observed. The finding is then graded as a nonconformity, a major nonconformity or an observation, using the ISO/IEC 17021-1 definitions. The output is the signed findings list that the organization receives at the closing meeting, and the step is complete when every finding names a requirement and its evidence.
Confirm the grading and scope of each finding
The organization checks that each finding describes the facts it observed and that the requirement cited is the right one. Disagreements about facts or grading should be raised with the audit team before the report is finalized, since the certification body records the grade it issues. The output is an agreed findings list or a documented disagreement, which the certification body keeps on file.
Respond with root cause and corrective action
For each nonconformity, the organization writes a response that explains the root cause, the correction made to the immediate problem, and the corrective action that removes the cause so it does not recur. This follows the approach in clause 10.2 of ISO/IEC 27001:2022. The owner of each action should be named, and the response should point to records that will exist when the auditor returns. The output is a written response per finding, with evidence references.
Certification body reviews the response
The certification body reviews each response to judge whether the root cause analysis is credible and whether the planned actions address the nonconformity as written. A weak response may be sent back for more detail before any verification takes place. The output is the certification body's acceptance of the response plan, or a request for revision, recorded against each finding.
Implement the actions and keep the records
The organization carries out the corrections and corrective actions and collects the records that prove they operate, such as updated procedures, training completion, access reviews or management review minutes. Records should show the action took effect over time, not only that a document was changed. The output is an evidence pack for each finding, ready for verification.
Verify corrections within the 6-month limit
The auditor verifies that corrections and corrective actions are in place for every major nonconformity, usually through a follow-up visit, document review or a combination, depending on the finding. Under the ISO/IEC 17021-1 rule cited in European Accreditation FAQ 36.14, verification must be completed within 6 months after the last day of stage 2. The output is a verified closure record for each major, and the certification body's decision to proceed with certification.
Repeat stage 2 when verification cannot be completed
If the certification body cannot verify corrections and corrective actions for every major nonconformity within the 6-month limit, it must conduct another stage 2 audit before it recommends certification. Because the interrupted stage 2 has no fixed limit on duration, the certification body applies a risk-based judgment to whether earlier results still hold, as explained in European Accreditation FAQ 36.14. The output is either a recommendation for certification or a repeated stage 2 with fresh findings.

What clause 10.2 asks the organization to do

Clause 10.2 of ISO/IEC 27001:2022 requires the organization to deal with each nonconformity in a traceable sequence. The organization reacts first, taking action to control and correct the problem and to deal with its consequences. It then reviews the cause, so the fix addresses why the gap happened rather than only the symptom. The organization also checks whether similar nonconformities exist elsewhere in the ISMS or could occur, implements whatever action is needed, and reviews whether that action worked. Throughout, it keeps documented information as evidence of each step, including the nature of the nonconformity, the actions taken and the results of those actions. Read the clause itself for the exact wording, and treat this summary as a working checklist rather than a substitute for it.

Clause 10.1, continual improvement, sets the broader expectation that the ISMS becomes more suitable and effective over time, and corrective action is one of the main ways that happens. Two other clauses feed the same cycle. Clause 9.2 on internal audit is often where nonconformities are first found, so the internal audit program and the corrective action log should reference each other. The NIST CSF 2.0 reference tool maps its ID.IM-01 improvement outcome to clauses 9.2, 10.1 and 10.2 and to Annex A control 5.35, which is useful when a customer asks how improvement work relates to other frameworks. Treat that mapping as a cross-reference only, not as proof that one framework satisfies another.

The organization owns this process, and it must own the decisions: who approves the root cause analysis, what counts as effective, and when a record is closed. A readiness partner can help test whether the record is credible, for example by checking that the cause analysis is specific, that the similar-risk check was actually performed, and that effectiveness evidence exists over time. A partner cannot sign off the closure. Closure is judged by the certification body during its next audit activity, so confirm with the body how it expects corrective action evidence to be presented before the audit date.

Who handles findings: the organization, the partner and the certification body

The organization owns the management system, so it also owns every finding raised against it. Its team investigates the root cause, decides on the corrective action, carries out the change and keeps the evidence that the change works. The certification body will not accept a fix that the organization has not made and cannot show, and no partner or auditor can make that decision on its behalf.

Root cause analysis: Internal staff establish why the requirement was not met, such as a missing review step, an unassigned owner or a tool that was never configured.
Corrective action under clause 10.2: The organization chooses and implements the action, assigns an owner and sets a completion date it can defend.
Records of the change: Updated procedures, approved risk treatment decisions, training records and configuration changes are signed off by people inside the organization.
Effectiveness checks: The organization shows that the corrected process has run in practice, not only that a document was rewritten.
Management review input: Findings and their status feed into the next management review, which is itself a record the auditor will sample.

Check that each finding has a named internal owner, a documented root cause and a closure record that someone other than the author has reviewed.

Which findings recur and how to prevent them

Most majors and repeat minors trace back to a small set of gaps between what the management system says and what the organization does. The cards below cover the root causes auditors meet most often, the clause family each one touches, and the check to run before stage 2 so the gap is closed while there is still time to act on it.

Policies that do not match practice

Policies describe a process the team does not follow, such as an access review that is written down but never run, or a backup rule that no one tests. Auditors compare documented rules with records, so the gap shows up quickly. This usually touches clause 5.2 on the information security policy and the Annex A controls the policy claims to implement. Before stage 2, pick three policies at random and trace each rule to a dated record showing it was performed.

Statement of Applicability out of step

The Statement of Applicability should list each Annex A control with a justification for including or excluding it, and it must agree with the risk treatment plan. A control marked as implemented with no matching treatment decision, or a risk treatment with no linked control, is a common finding. This ties clause 6.1.3 to the Annex A controls. Before stage 2, check that every risk treatment option traces to at least one control and that every included control traces back to a treatment.

Internal audits that test paperwork

Internal audits often confirm that a procedure exists and skip whether it works in practice. Auditors look for internal audit reports that sample real records, cover each clause and control, and record effectiveness conclusions. Weak internal audits typically surface as a major nonconformity against clause 9.2, because the organization cannot show it checks its own system. Before stage 2, confirm that the internal audit programme covers all clauses, that the auditors were independent of the area audited, and that findings have owners and closure dates.

Management review without recorded decisions

Management review under clause 9.3 must consider defined inputs, such as audit results, risk changes, and performance of objectives, and must record decisions and actions. Minutes that list attendees and agenda items but no outcomes are a frequent finding. The gap sits in clause 9.3 and often leads to repeat findings because no one owns the follow-up. Before stage 2, check that the last review minutes show each required input, a decision for each, and an action with an owner that was closed or is on schedule.

Evidence scattered across tools

When records for one control sit in a ticketing system, a shared drive, a chat channel and an email inbox, the team struggles to show the same evidence on request. Auditors then sample a record and cannot find its matching approval or review. This weakens the documented information requirements in clause 7.5 and the audit trail for controls in Annex A. Before stage 2, choose one location per control for its evidence, name the owner, and walk through the evidence for three controls end to end as an auditor would.

Deadlines that set the clock for closing findings

This table sets out the main time limits that apply once a certification body has issued findings, and what each one means for the next audit decision. Read each row against your own audit timetable, then confirm the exact dates in writing with your certification body, because the clock often starts from a specific event such as the last day of stage 2 or the certificate expiry date.

Situation	Rule	What to confirm
Closing major nonconformities after stage 2	Corrections and corrective actions for every major nonconformity must be verified within 6 months after the last day of stage 2. If they are not verified in that window, another stage 2 audit is needed before certification can be recommended.	Ask the certification body for the exact end date of the 6-month window, how it counts from the last day of stage 2, and what evidence it will accept to verify each major.
Interrupted stage 2 audit	ISO/IEC 17021-1 sets no fixed limit on how long a stage 2 audit can stay interrupted. The certification body takes a risk-based view of whether earlier results still stand.	Ask how long the body will keep earlier stage 2 results, what would trigger a repeat of part or all of stage 2, and whether that decision is recorded in writing.
Recertification before certificate expiry	If the recertification audit is not completed, or corrections for any major nonconformity are not verified, before the certificate expires, recertification is not recommended and the certificate validity is not extended (ISO/IEC 17021-1, clause 9.6.3.2.4).	Confirm your certificate expiry date, the date the recertification audit must finish, and the latest date by which major corrections must be verified.
Restoring an expired certificate	After expiry, the certification body can restore the certificate within 6 months if the outstanding recertification activities are completed. Otherwise, at least a stage 2 audit is required (ISO/IEC 17021-1, clause 9.6.3.2.5).	Ask whether the body would restore the certificate in your case, which activities it would require, and what it would need to see before deciding that a full stage 2 is necessary.
Transition from 2013 certificates	Under IAF MD 26:2023, all certifications to ISO/IEC 27001:2013 had to expire or be withdrawn by 31 October 2025, the end of the 36-month transition period. Certificates still showing the 2013 edition after that date are no longer valid.	Check that your certificate and any open findings refer to ISO/IEC 27001:2022, and ask the body how the transition was recorded against your certificate.

How to tell whether a finding will become a major

The practical test is whether a finding breaks a control that is central to what the management system is meant to do, or whether it shows that the system does not operate as documented. A finding that points to a system that does not work tends to be graded major. Examples include a risk assessment that was never repeated, internal audits that did not happen, management review that never looked at results, or a Statement of Applicability that claims controls the organization does not run. An isolated lapse with a clear root cause and a fix already in place, such as one leaver whose account stayed active for a few days before it was removed, tends to be graded minor. The definitions in ISO/IEC 17021-1 turn on whether the system's ability to achieve its intended results is affected, so the auditor will ask how far the failure reaches, not only how serious the single instance looks.

The certification body makes this decision, not the organization or its implementation partner. Auditors weigh the evidence in front of them, and an organization can argue its case, but it should not plan on reclassifying a finding after the closing meeting. The useful work is therefore before stage 2. Walk each clause of the management system and each applicable Annex A control and ask whether a single failure would look like an isolated slip or like a gap in the process. Check that records exist for every recurring activity, that internal audit and management review have actually run, and that corrective actions from earlier findings were recorded and followed through. Confirm with your certification body how it sets the interval between stage 1 and stage 2 and what it expects you to have operating by then, since the timing rules in European Accreditation FAQ 49.3 are a matter to confirm against the body's own procedures.

Questions buyers ask about ISO 27001 findings and closure

Can a pre-audit help us avoid major nonconformities?

A pre-audit can reduce surprises, but it cannot replace stage 1 and it does not bind the certification body. Only the certification body decides how a finding is graded, and it does so from its own review of your documented system and what it observes on site. A pre-audit run by a consultant or implementation partner is useful for finding gaps such as a missing management review record or an internal audit that never happened. Ask the partner to report what they tested and how, and ask the certification body to confirm which parts of your readiness it will examine. Treat the pre-audit as preparation, not as a dress rehearsal that guarantees a result.

How long do we have to close a major nonconformity?

The rule supplied for certification is a six-month limit measured from the last day of stage 2. If the certification body cannot verify corrections and corrective actions for every major nonconformity within that period, it must carry out another stage 2 before it can recommend certification. ISO/IEC 17021-1 sets no fixed limit on how long an interrupted stage 2 can stay open, so the body applies a risk-based judgment to whether earlier results still hold. Confirm the exact timetable, evidence format and any re-audit fees with your certification body in writing before the audit, because its own procedures set the working steps.

Can our consultant close the finding for us?

No. Your consultant can help you find the root cause, write the corrective action, update the procedure and collect the records, but the certification body verifies that the correction works. Closure depends on evidence the auditor can examine, such as a revised process that has operated, records of its use, and proof that the fix addresses the cause and not only the symptom. The organization owns the control and signs the corrective action plan. A consultant who offers to submit closure on your behalf, or to guarantee a grade, is describing a role the certification body does not allow.

What does a minor nonconformity cost us?

A minor nonconformity usually carries no fixed fee, but it carries effort and record-keeping. You still need a documented correction and corrective action, the auditor will check it at the next scheduled audit, and the finding stays in your audit history. The real cost is the internal time of the process owner, any fix to tooling or documentation, and the risk that repeated minors show weak control of the system. Your certification body sets its own fees for follow-up work, so ask it how minors are verified and whether any additional audit time applies. No fee figure has been supplied for this topic.

Do we need new tools to fix findings?

Usually not. Most findings are about a process that is undocumented, not followed, or not measured, and the fix is a written procedure, a named owner, and records that show the process running. Tools become relevant when the evidence cannot be produced reliably, for example when access reviews or logs are scattered across systems. In that case, a self-hosted open-source platform inside your own infrastructure may help you collect and retain records. Confirm each tool's capabilities against your requirement before you buy or deploy anything, and make sure the change itself is tested before the auditor arrives.

What do we need from our team to close findings?

You need a named owner for each affected process, the evidence that the process runs, and enough time for that owner to respond. The owner analyzes the root cause, agrees the corrective action, and shows the records the auditor will test. Security, IT and the managers of the affected business area often share the work. Plan for the owner to run the fix for a period before verification, because the auditor needs to see the change operating, not only described. Your implementation partner can prepare systems and evidence, but the people who run the process must stay accountable for it.

How DeployOpen works on this

DeployOpen helps organizations prepare the systems, controls and evidence that a finding needs before the certification body re-checks it. The organization owns its controls and its corrective action decisions, and only the independent certification body verifies closure and issues the certificate.

How we scope

Each engagement starts with a written scope listing the findings, clauses and Annex A controls to be addressed.
We confirm with you which findings are major nonconformities and which deadlines apply under your certification body's plan.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.
Scope excludes the certification decision itself, which remains with the certification body.

How we build

We configure self-hosted open-source platforms in your own cloud accounts or data centers to produce the evidence each finding requires.
We document the root cause analysis, corrective action plan and updated procedures under clause 10.2 in a format your team can maintain.
We test that each corrective action works in practice, with records showing when the change was made and who approved it.
We help your team prepare a verification pack that shows the auditor how each finding was resolved.

How we hand over

You receive the evidence pack, configuration records, runbooks and a closure map linking each finding to its evidence.
Your staff are trained to run the controls and collect records so the evidence stays current after handover.
We do not issue audit reports or certificates; the independent certification body decides whether findings are closed.
Ask your certification body in advance which evidence format it expects for verification.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the written scope ends.
Retainers can cover evidence collection between surveillance audits and preparation for the next recertification cycle.
Scope changes, such as new sites or services, are priced and agreed in writing before work begins.
Confirm the retainer scope, response expectations and reporting cadence in the written agreement before signing.

ISO 27001 nonconformities: major, minor and corrective action