What is a requirement for a corrective action made in response to a nonconformity?

According to ISO/IEC 27001:2022, Clause 10.2, when a nonconformity occurs, the organization must implement corrective actions as needed. The standard explicitly states, "Corrective actions shall be appropriate to the effects of the nonconformities encountered." This requirement ensures that the resources and effort invested in fixing a problem are proportional to the actual or potential impact of that problem on the organization's information security objectives. The response must be suitable for the severity and consequences of the identified issue.

A. The standard requires actions to be appropriate to the effects of the nonconformity, not proportionate to the likelihood of its recurrence.

C. Corrective actions may require changes to the ISMS, including policies, as stated in Clause 10.2 e) of the standard.

D. The standard requires an evaluation of the need to eliminate the cause, which does not mean the cause is always eliminated.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Section 10.2 Continual improvement. The standard states: "When a nonconformity occurs, the organization shall: ... c) implement any action needed; ... Corrective actions shall be appropriate to the effects of the nonconformities encountered."

2. Calder, A., & Watkins, S. (2020). IT Governance: An International Guide to Data Security and ISO 27001/ISO 27002 (7th ed.). Kogan Page. In its analysis of Clause 10.1 (from the 2013 version, conceptually identical to 10.2 in the 2022 version), the guide emphasizes that the scale of the corrective action must match the scale of the problem it is intended to solve (Chapter 15, pp. 169-170).

3. Humphreys, E. (2016). Implementing the ISO/IEC 27001:2013 ISMS Standard. Artech House. In the discussion on Clause 10.1, the author notes, "The final requirement... is that the corrective actions taken must be appropriate to the impacts of the nonconformities encountered. This is a test of proportionality." (Chapter 12, Section 10.1 Nonconformity and Corrective Action).