What's the difference?

A minor non-conformity usually means there is a discrete or isolated problem, but the ISMS still functions overall.

Examples of minor nonconformities can include a policy exists and is approved, but one department is using an outdated version.

Staff understand policies, but one person does not know where to find them.

Access reviews are conducted quarterly, but evidence for a particular system is missing.

Policies exist, but do not reflect real operations.

These issues should still be fixed, but they do not indicate a complete system failure.

So what do organisations need to do to meet the requirements of clause 10.2?