Major Nonconformity
Definition
A finding that indicates the ISMS is absent in a required area or has failed systemically. Must be resolved with verified evidence before a certificate is issued or maintained. Unresolved major nonconformities lead to suspension or withdrawal.
- Scope
- ISMS control absent or systemically failed
- Resolution requirement
- Verified evidence before certification
- If unresolved
- Certificate suspension or withdrawal
- Standard
- ISO/IEC 27001
Common questions
How does a major nonconformity differ from a minor one in an ISO 27001 audit?+
A minor nonconformity is an isolated lapse that does not indicate the control itself has failed, while a major nonconformity shows the control is missing entirely or has broken down systemically, and must typically be closed before certification proceeds.
What must an organisation provide to close out a major nonconformity?+
Verified evidence that the corrective action was implemented and is functioning, not just a written plan; auditors generally require proof of effectiveness rather than a promise to fix it.
Related terms
- Accreditation Body (AB)
- A national body that assesses and formally recognises the competence of certification bodies. Notable examples: UKAS (UK), DAkkS (Germany), COFRAC (France), NABCB...
- Certification Body (CB)
- An independent third-party organisation accredited to audit and certify that an ISMS conforms to ISO 27001. Examples include BSI, Bureau Veritas, DNV,...
- Minor Nonconformity
- A single lapse or gap that does not indicate systemic failure. The organisation must provide a corrective action plan and close the...
- Stage 1 Audit
- The documentation review phase of the initial certification audit. The auditor checks that the ISMS documentation exists, the scope is defined, the...
- Stage 2 Audit
- The on-site certification audit. The auditor tests whether controls described in the documentation are implemented and operating effectively. A Stage 2 pass...