KIS ISMS Module 20: Nonconformity and Corrective Action Toolkit

Description

Close findings with a documented response, cause analysis and a separate test of effectiveness. This coordinated toolkit gives your team practical templates for recording a nonconformity, containing immediate exposure, assigning corrective action and tracing the evidence through independent review.

What is included

• Policy and procedure (DOCX + PDF): responsibilities, intake, containment, correction, cause and extent analysis, action approval, effectiveness review, closure and records.
• Eight-tab workbook (XLSX): dashboard, start guide, issue register, cause analysis, action plan, effectiveness checks, closure and learning, and controlled lists.
• Editable briefing (PPTX): an eight-slide walkthrough for process owners, the ISMS steering committee and management.
• Complete ZIP: all files with a practical readme.

Use it in a real workflow

1. Record the applicable requirement, scope, observed facts, date, source and evidence location.
2. Contain ongoing exposure and correct the specific case. Preserve records and route any incident, privacy, contractual or legal trigger to the relevant process.
3. Analyze why the process allowed the issue and how far it may extend. Record sample limits and distinguish evidence from assumptions.
4. Approve actions against the supported cause, with an accountable owner, authority, resources, due date and change record.
5. Set acceptance criteria before the action closes. A reviewer records the sample, evidence and result. Keep an item open when the test is pending, partly effective or unsuccessful.
6. Update related risk, SoA, procedures, training and management reporting, then record closure and learning.

Worked example

A former employee account remains active after departure. Contain the exposure and preserve sign-in evidence, then review the HR-to-identity hand-off and determine whether other departures may be affected. Link the action to the process cause, connect the HR event to an identity ticket, and later sample departures to test that removal and exception handling work. Removing one account fixes the case; the sample tests whether the process changed.

Reference and scope

Designed as an original KIS implementation aid focused on ISO/IEC 27001:2022 clause 10.2, with related references to clause 10.1 and Annex A controls 5.27, 5.35 and 5.36. It does not reproduce official ISO text. Validate against a licensed standard and current amendment materials.

Important: This toolkit is not legal advice, an audit opinion or a certification guarantee. Tailor it to your organization’s risks, obligations, contracts and operating model. KIS is not affiliated with or endorsed by ISO or IEC.