Request a callback

Glossary · ISO/IEC 27001:2022 · clause 10.2

Nonconformity

Definition

ISO/IEC 27001:2022 · clause 10.2

A failure to meet a requirement of the standard, of your own management system, or of a legal obligation you have brought into scope. Clause 10.2 requires you to react, correct, find the root cause and check that the corrective action worked. Certification bodies grade findings as major (a breakdown that blocks certification until closed) or minor (an isolated lapse, closed through an agreed plan); an "opportunity for improvement" is not a nonconformity.

Also called findingmajor or minor nonconformityNC

In other laws

LawTermNote
SOC 2 (AICPA)ExceptionA test result the auditor reports, not a grade; it does not block the report but appears in it and can qualify the opinion.

Where it appears

Related terms