ISO 27001 Clause 10.2 is Nonconformity and Corrective Action. It requires an organisation to identify and manage nonconformities. Nonconformities are deviations to the norm. If a policy or process is not operating as expected, that would be classed as a nonconformity.

Correction and corrective action are two entirely different concepts, with correction defined in ISO 9000:2015 as “action to eliminate a detected nonconformity” and corrective action defined as “action to eliminate the cause of a nonconformity and to prevent recurrence”.

Clause 10.2 Nonconformity and corrective action. ISO 9001:2015 requires that when a nonconformity occurs, including any arising from customer complaints, organisations to take the following steps: Immediate containment actions. IE: React to the nonconformity and as appropriate, take action to control and correct it and deal with the consequences.