A non-conformity is the non-fulfilment of a requirement. That is the definition in ISO 9000, and ISO 27001, ISO 9001 and the other ISO management system standards use the term the same way. The requirement can come from the standard itself, from a law or a contract, or from the organisation's own policy: a procedure you wrote and do not follow is a non-conformity too.
Major and minor non-conformities
Certification bodies grade what they find. ISO/IEC 17021-1, the standard certification bodies themselves work to, calls a non-conformity major when it affects the capability of the management system to achieve its intended results, and minor when it does not. In practice a major is a requirement that is not addressed at all, or a failure that repeats across the organisation, such as no internal audit programme or a risk assessment that was never carried out. A minor is an isolated lapse in a system that otherwise works, such as one skipped access review. Several minors against the same requirement can together count as a major.
The grade decides what happens next. A major found in a certification audit has to be corrected, and the certification body has to verify the correction, before a certificate is issued; in a surveillance audit it puts an existing certificate at risk. For a minor, the auditor normally accepts a plan with a deadline and checks it at the next visit. An observation or opportunity for improvement is not a non-conformity and needs no formal response.
Closing a non-conformity
Clause 10.2 of ISO 27001 sets out the steps, and ISO 9001 has the same clause. React first: contain the problem and deal with its consequences. Then find the cause, check whether the same problem exists elsewhere or could occur, and take a corrective action that removes the cause. Finally review whether that action worked, and keep a record of the non-conformity, what you did and the result. Auditors read those records as evidence that the management system corrects itself.