ISO/IEC 42001:2023 10.2: Nonconformity and corrective action
When a nonconformity occurs, react by controlling and correcting it and dealing with consequences; evaluate whether action is needed to remove its causes so it does not recur or happen elsewhere, by reviewing it, finding its causes and checking for similar cases; implement any action needed; review how effective the corrective action was; and change the AIMS if necessary. Corrective action must fit the effects of the nonconformity, and documented evidence of the nonconformity, the actions taken and the results must be kept.
This control maps to 76 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated
You are reading one control. How much of ISO/IEC 42001:2023 have you already done?
ISO/IEC 42001:2023 10.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.