Nonconformity and corrective-action register
Control failures get a numbered entry with root cause, corrective actions, and a separately dated effectiveness review before closure, and a fix verified on the day it shipped counts as a correction rather than a demonstrated corrective action. Four were raised, three are closed, and where a closure criterion was changed rather than met the register says so, names the owner and the date, and carries the decision to the next management review.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- 10.2Nonconformity and corrective action
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.