Handling nonconformities

Answer: I'm assuming you are referring to control A.6.1.5 - Information security in project management.

First it is important to note that there are many similarities with implementing an ISMS in an organisation that you can use to drive the implementation of this control in a specific project:

1 – You have to define information security objectives and include them in the project objectives, the same way you define information security objectives for an ISMS aligned with organization's objectives, the only difference is that these objectives are restricted to the scope of the project

2 – You have to perform at the beginning, and periodically, information risk assessments in the project, like you would do it with other business processes, to identify necessary controls

3 – You have to ensure that information security practices are part of all phases of the project (e.g., from the issue of the project charter to project closing)

In short, you can think the inclusion of information security in project management as if you are going to implement a small ISMS that will fit the projects needs and will be proportional to the project's lifetime and budget.

Considering these, you would be using the same documents you use for an ISM applied to your organization (there is no need for documents specific for managing information security in a project) , and for any non conformity related to ISO 27001 you can use a document called Corrective Action Form, which describes the non-conformity, its cause, defines corrective / preventive actions and verification method of their implementation.

To see how this document looks like, I suggest you to take a look at this free demo: https://advisera.com/27001academy/documentation/procedure-for-document-and-record-control/

This article will provide you further explanation about non conformities:
- Practical use of corrective actions for ISO 27001 and ISO 22301 https://advisera.com/27001academy/blog/2013/12/09/practical-use-of-corrective-actions-for-iso-27001-and-iso-22301/