Purpose. The log that the Procedure for the Management of Nonconformity
(ISMS-DOC-10-1 §3) requires: every failure to meet a requirement of ISO/IEC 27001, of
Soon's own ISMS, or of a legal or contractual obligation, tracked from detection to a
verified fix. Security incidents are recorded separately, in the
Security Incident Register. An incident
that reveals a control failure gets an entry here as well.
Reviewed at each quarterly security review and at management review. A nonconformity is
closed only once the corrective action has been shown to work.
1. Summary
| ID |
Opened |
Nonconformity |
Severity |
Source |
Owner |
Status |
| NC-2026-01 |
2026-09-29 |
Evidence store unavailable through the site for 33 days |
Minor |
Own monitoring (ISMS check) |
Olaf Jacobson |
Corrected; corrective action open |
| NC-2026-02 |
2026-10-13 |
Owner approvals of 9 September 2026 never reached main |
Minor |
Own review during audit preparation |
Olaf Jacobson |
Corrected; corrective action open |
| NC-2026-03 |
2026-10-13 |
SOC 2 evidence pack of 9 September 2026 incomplete |
Minor |
External review (GetAgency, auditor's follow-up comments) |
Olaf Jacobson |
Correction in progress |
2. Entries
NC-2026-01 — Evidence store unavailable through the site for 33 days
|
|
| What |
From the merge of PR #94 (10 Sep 2026, 11:22) until 13 Oct 2026 (12:12), every evidence upload, listing and review through isms.soon.works returned 401 ("Access JWT did not verify: ACCESS_TEAM_DOMAIN not configured"). Requirement not met: evidence capture under the Evidence Collection and Management Procedure (ISMS-DOC-07-7), and ISO 27001 7.5.3 (documented information available when needed) |
| Detected |
Flagged as a likely failure on 23 Sep 2026; confirmed on 29 Sep 2026 |
| Consequences |
None lost. Command-line capture (tools/evidence.py) writes to the store directly and kept working. Captures and set-asides through the site were delayed, so stale items stayed in the pack until 13 Oct |
| Correction |
13 Oct 2026: ACCESS_TEAM_DOMAIN and ACCESS_AUD set on the Cloudflare Pages project and the production deployment redeployed. Verified: the API answers signedIn: true (via JWT) |
| Root cause |
PR #94 made the API verify the Cloudflare Access token and fail closed when its configuration is missing (correct by design). The two variables it depends on were described in the PR, but setting them was never part of the deployment, and nothing checked the API after the release. A second cause: 14 days passed between confirmation and the fix, because nobody owned the fix |
| Corrective action |
(1) After any change to the site's functions/, the person merging opens isms.soon.works/api/evidence and confirms signedIn: true before considering the release done. (2) Configuration a release depends on is listed in the PR and ticked off by the person merging. (3) A confirmed control failure gets a named owner and a date on the day it is confirmed |
| Owner / due |
Olaf Jacobson · 2026-10-31 |
| Verification |
At the Q4 2026 quarterly security review: check that the next functions/ release was followed by the check above |
| Status |
Corrected; corrective action open |
NC-2026-02 — Owner approvals of 9 September 2026 never reached main
|
|
| What |
On 9 Sep 2026 the owner stamped approvals in a local checkout (~/s/isms), but they were never committed. Six documents stayed draft on main, and so in the evidence pack, although they had been approved (SOC 2 rows 14, 41–43, 51 and 63). Requirement not met: ISO 27001 7.5.2 and 7.5.3 (approval and control of documented information) |
| Detected |
13 Oct 2026, while checking the auditor's comments |
| Consequences |
The 9 Sep pack showed approved documents as drafts. No document content was affected |
| Correction |
13 Oct 2026: four documents whose text was unchanged were restored with their original 9 Sep approval stamps. The two whose text had changed since were re-approved by the owner |
| Root cause |
tools/approve.py writes the approval into the local files only. Committing and merging is a separate step, and nothing reported approvals left uncommitted |
| Corrective action |
Approvals are stamped on a branch and committed in the same sitting, then go through a PR like any other change (as done since 13 Oct). Before each evidence pack is sent, the ISM checks STATUS.md on main against the approvals expected |
| Owner / due |
Olaf Jacobson · 2026-10-31 |
| Verification |
At the Q4 2026 quarterly security review: no local checkout holds uncommitted approvals, and every approval in the period is visible in main's history |
| Status |
Corrected; corrective action open |
NC-2026-03 — SOC 2 evidence pack of 9 September 2026 incomplete
|
|
| What |
The auditor's coordinator left 12 follow-up comments on the pack. Evidence was missing (rows 10, 11, 24, 28, 33, 45, 65, 66), unsigned (rows 3, 4), undated (row 8), or a screenshot of a tool rather than the policy (row 1). Soon's own re-check found more: rows 59 and 60 marked done without evidence; row 2 holding only a template; row 34 holding a screenshot from before GitHub 2FA was enforced |
| Detected |
13 Oct 2026 (comments on the checklist sheet) |
| Consequences |
The audit's evidence review was delayed. No control was found to be absent; the gaps were in the evidence of the controls |
| Correction |
Each row has been corrected, or has an owner for its correction (see ISMS-FORM-09-9 and the revised pack). Stale or misleading items were set aside in the store, each with its reason. Still open: row 45 (network diagram review), rows 59, 60 and 66 (incident-response and DR exercise with a live restore) |
| Root cause |
Rows were marked done once the policy existed, without checking that the evidence in the pack showed the control operating, signed and dated. The export did not check evidence for each row |
| Corrective action |
Before a pack is sent: every row marked done has at least one current artefact in the export that is dated and, where required, signed. The check is done row by row against the export's manifest, and the result is recorded in the covering email |
| Owner / due |
Olaf Jacobson · before the revised pack is sent |
| Verification |
The auditor raises no further comment of the same kind on the revised pack |
| Status |
Correction in progress |
Change log
| Version |
Date |
Author |
Change |
| 0.1 |
2026-10-17 |
ISMS |
First version of the log required by ISMS-DOC-10-1 §3, with the three nonconformities found during SOC 2 audit preparation. |