thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Corrective Action

Action to eliminate the cause of a nonconformity or incident and prevent recurrence.

Definition

ISO/IEC 27001 Clause 10.2 requires reacting to nonconformities, evaluating the need to eliminate causes, implementing action, reviewing effectiveness, and updating the ISMS. Correction fixes the immediate problem, while corrective action addresses root cause.

Example

After finding unapproved firewall changes, the team fixes them (correction) and implements automated change approval workflow (corrective action).

Exam tip

Correction is not the same as corrective action.

Related terms