A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A major nonconformity is a Stage 2 finding serious enough to block ISO 27001 certification: a required element of the management system is absent, a control has failed systemically, or several minor findings point at the same underlying process failure. The certificate is withheld until the finding is remediated and verified.
The distinction matters commercially. Minors are normal and get a corrective action window. A major moves your certification date and adds audit days to the invoice.
Most majors are avoidable at the readiness stage, because they are absences rather than weaknesses. The internal audit either happened or it did not.
traztech delivers ISO 27001 implementation and Stage 2 readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
It comes up at Stage 2, which is the point where ISO 27001 stops being a documentation exercise. A certification body grades what it finds, and the grade decides whether a certificate is issued that day.
It also comes up in planning, because the majors are predictable. A scope that was never properly defined, a Statement of Applicability with unjustified exclusions, an internal audit that never ran and a management review that exists only as a calendar invite account for a large share of them.
More directly than SOC 2, yes. A major nonconformity at Stage 2 blocks certification until you remediate and the body verifies the fix, usually at additional audit days you pay for.
A minor is an isolated lapse and comes with a corrective action window without blocking the certificate. A major is a systemic failure, an entirely absent requirement, or several minors pointing at the same broken process.
Certification bodies typically set a window of a few months and then verify. The practical cost is the delay and the extra audit days, not the finding itself.