Jul 23, 2026 · 11 min · 10 segments
In this episode of InfoSec Insider, Neil Jones, Senior Consultant at URM, shares key advice and guidance on ISO 27001 Clause 10.2 (Nonconformity and corrective action), its requirements and how…
Neil JonesGuestAnnieHostSo to begin, could you, Neil, just give us a quick sort of high level overview of what Clause 10.2 is and why it is important for organisations to manage problems with their ISMS?
Yes, so Clause 10, nonconformity and corrective action requires organisations to have controls in place to handle issues with their ISMS.
So in simple terms, when an issue arises or requirements are not met, the organisations must fix the issue, understand why it occurred, prevent it from happening again, and provide evidence that the fix is effective.
As well as supporting continual improvement, this clause is important since auditors, including external assessors, often use it to judge the maturity of the ISMS.
An organisation may have strong, well-documented controls, but without an equally strong corrective action process, the ICMS may be considered weak and not sufficiently resilient.
As a consequence, repeated failures to meet requirements of clause 10.2 often lead to major nonconformities.
So to begin, could you, Neil, just give us a quick sort of high level overview of what Clause 10.2 is and why it is important for organisations to manage problems with their ISMS?
Yes, so Clause 10, nonconformity and corrective action requires organisations to have controls in place to handle issues with their ISMS.
So in simple terms, when an issue arises or requirements are not met, the organisations must fix the issue, understand why it occurred, prevent it from happening again, and provide evidence that the fix is effective.
As well as supporting continual improvement, this clause is important since auditors, including external assessors, often use it to judge the maturity of the ISMS.
An organisation may have strong, well-documented controls, but without an equally strong corrective action process, the ICMS may be considered weak and not sufficiently resilient.
As a consequence, repeated failures to meet requirements of clause 10.2 often lead to major nonconformities.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
