ISMS Management System: Common Nonconformities
ISO 27001 is first and foremost a management system standard. Nonconformities in Clauses 4-10 indicate systemic issues that undermine the entire ISMS.
Clause 4: Context
ISMS scope not clearly defined or does not account for all relevant stakeholder requirements
Clause 5: Leadership
Top management not demonstrably committed; information security policy not communicated
Clause 6: Planning
Risk assessment methodology not documented or not consistently applied
Clause 7: Support
Insufficient resources, competency gaps, or inadequate documented information
Clause 8: Operation
Risk treatment plan not executed; operational processes not controlled
Clause 9: Performance Evaluation
Internal audits not conducted; management review not performed or documented
Clause 10: Improvement
Nonconformities not tracked; no evidence of corrective actions or continual improvement
Annex A Control Domains
ISO 27001:2022 includes 93 controls organized into four domains. Here are the most common findings in each.
Policies, roles, responsibilities, asset management, and information classification.
Top Findings
Screening, training, awareness, disciplinary processes, and remote working.
Top Findings
Physical perimeters, entry controls, securing offices, equipment protection.
Top Findings
Authentication, access rights, malware protection, logging, encryption, and development security.
Top Findings
Our ISO 27001 Remediation Approach
Nonconformity Analysis
Review all major and minor nonconformities from the certification audit. Map each to specific clauses and Annex A controls.
Root Cause Analysis
Identify the systemic root causes behind nonconformities. Surface-level fixes lead to repeat findings at surveillance audits.
Statement of Applicability Update
Review and update the SoA to ensure it accurately reflects your risk assessment and control selections.
Corrective Action Implementation
Implement corrective actions that address both the specific finding and the underlying root cause.
Evidence and Documentation
Build the documentation and evidence trail that demonstrates effective corrective action implementation.
Internal Audit Verification
Conduct a targeted internal audit to verify corrective actions are effective before the certification body returns.