Your security and compliance glossary

All the terms you need to know when you’re trying to get compliance audit ready, fast.

Show filters
ISO 27001
ISO 27001 Nonconformities

What is an ISO 27001 nonconformity?

An ISO 27001 nonconformity is an organization’s non-fulfillment of a requirement of the ISO standard. Both major and minor nonconformities may be recorded in the process of a company’s certification audit. The presence of a major nonconformity means that a company cannot get certified. 

An organization is at risk of nonconformity if they have not fulfilled the standard requirements of the ISO 27001; if an organization’s documentation specified a process the organization is not following; or if an organization is not upholding contractual requirements in its dealings with third parties.  

A company’s ISO auditor will utilize nonconformities to judge the compliance of that company’s Information Security Management System (ISMS) against the ISO standard. An auditor will describe the nonconformity, provide evidence of the issue, reference by clause the requirement that is not being adequately addressed, and summarize what must be done to meet the stated requirement.

Examples of major nonconformities include:

  • Failure to fulfill a certain requirement of the standard
  • Absence of mandatory documentation
  • Breakdown of a process or procedure
  • Accumulation of minor nonconformities about one process or element of an organization’s management system, illuminating a larger problem 
  • Misuse of a certification mark, thus misleading customers 
  • Unresolved minor nonconformities

The compliance news you need. Delivered securely to your inbox.

Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes

Everything you need to get compliance audit ready, fast.