Skip to content

Nonconformity

What is Nonconformity?

A failure to fulfil a requirement. In ISO management systems, nonconformities found during audits must be addressed through corrective actions to eliminate the root cause.

Information Security

Related terms

Corrective ActionAudit

Frameworks that govern nonconformity

ISO 27001:2022View framework →NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on nonconformity

Requirements naming nonconformity across 6 standards, quoted from the control text.

ISO 22301:20192 controls

Determine opportunities for improvement and implement the actions needed to achieve the intended BCMS outcomes; when a nonconformity occurs, react to it and deal with its consequences, evaluate whether action is needed to eliminate the cause by reviewing the n...

iso-22301-2019::10.1 · Nonconformity and corrective action →
ISO 22313:2020 - Guidance on Business Continuity Management Systems2 controls

Guidance on reacting to nonconformities, evaluating the need for corrective action, and implementing changes.

ISO-22313-10.1 · Nonconformity and corrective action →
ISO 37002:2021 - Whistleblowing Management Systems2 controls

Identify nonconformities, conduct root cause analysis, and implement corrective actions with verified effectiveness.

ISO37002-10.2 · Nonconformity and Corrective Action →
ISO 39001:2012 - Road Traffic Safety Management2 controls

Act on nonconformities including incidents, determine causes, and implement corrective action.

ISO39001-10.1 · Nonconformity and Corrective Action →
ISO 50001:2018 - Energy Management Systems2 controls

Requires reacting to nonconformities, determining root causes, and implementing corrective actions.

ISO-50001-10.1 · Nonconformity and corrective action →
ISO/IEC 27003:20172 controls

React to nonconformities, evaluate need for action to eliminate causes, implement corrections, and review effectiveness.

27003-10.1 · Nonconformity and Corrective Action →

Questions people ask about nonconformity

What is Nonconformity?
A failure to fulfil a requirement. In ISO management systems, nonconformities found during audits must be addressed through corrective actions to eliminate the root cause.
Why is Nonconformity important for compliance?
Nonconformity is a key concept in Information Security. Understanding nonconformity helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Nonconformity?
Key concepts related to Nonconformity include Corrective Action, Audit. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Nonconformity?
Nonconformity appears in the requirement text of ISO 22301:2019, ISO 22313:2020 - Guidance on Business Continuity Management Systems, ISO 37002:2021 - Whistleblowing Management Systems, ISO 39001:2012 - Road Traffic Safety Management, ISO 50001:2018 - Energy Management Systems. Across these standards we have identified 12 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Nonconformity?
Explore our compliance framework pages to see how nonconformity applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Nonconformity applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.