Everything hangs on the classification. A minor nonconformity is an isolated lapse — one unreviewed supplier, one stale record — and certification usually proceeds once the certification body accepts your corrective action plan, verified at the next surveillance visit. A major is systemic: an ISMS requirement missing, or a control failing wholesale. Majors block the certificate (or suspend an existing one) until corrective action is verified, commonly within about ninety days and sometimes via a follow-up visit.
Corrective action means root cause, not spot repair. The certification body wants to know why the management system allowed the failure and what changed structurally — with evidence. Closing the one expired access review while leaving the review process unowned will fail verification; fixing the cadence, the owner, and the record-keeping passes it.
Keep perspective: nonconformities at Stage 2 and surveillance are ordinary, the recovery loop is written into the certification scheme, and running it competently is itself evidence the ISMS works. Handled well, the whole cycle gets boring — CloudCover passed ISO 27001 with zero findings.
The recurring root causes are the same three everywhere: an ISMS that exists as documents rather than operations, a single overloaded owner, and no internal audit run before the external one arrives. Right-size the program to the company you actually are — ISO 27001 for startups covers that shape — and if the honest answer is that nobody has cycles to operate it, that’s the gap managed compliance services close.
Normally no — verification targets the failed areas, by document review or a focused follow-up visit. A full Stage 2 repeat comes back on the table when majors aren’t closed inside the certification body’s window, so treat that deadline as real.
Audit reports stay private, but certificate status is checkable with the certification body — a suspension is discoverable. If a buyer asks mid-remediation, share the corrective action plan and its dates; a dated recovery story holds deals that silence loses.
