ISO 27001:2022

ISO 27001 Organisation Controls

ISO 27001 Annex A 5.1: Policies for information security

ISO 27001 Annex A 5.2: Information Security Roles and Responsibilities

ISO 27001 Annex A 5.3: Segregation of duties

ISO 27001 Annex A 5.4: Management responsibilities

ISO 27001 Annex A 5.5: Contact with authorities

ISO 27001 Annex A 5.6: Contact with special interest groups

ISO 27001 Annex A 5.7: Threat intelligence

ISO 27001 Annex A 5.8: Information security in project management

ISO 27001 Annex A 5.9: Inventory of information and other associated assets

ISO 27001 Annex A 5.10: Acceptable use of information and other associated assets

ISO 27001 Annex A 5.11: Return of assets

ISO 27001 Annex A 5.12: Classification of information

ISO 27001 Annex A 5.13: Labelling of information

ISO 27001 Annex A 5.14: Information transfer

ISO 27001 Annex A 5.15: Access control

ISO 27001 Annex A 5.16: Identity management

ISO 27001 Annex A 5.17: Authentication information

ISO 27001 Annex A 5.18: Access rights

ISO 27001 Annex A 5.19: Information security in supplier relationships

ISO 27001 Annex A 5.20: Addressing information security within supplier agreements

ISO 27001 Annex A 5.21: Managing information security in the ICT supply chain

ISO 27001 Annex A 5.22: Monitoring, review and change management of supplier services

ISO 27001 Annex A 5.23: Information security for use of cloud services

ISO 27001 Annex A 5.24: Information security incident management planning and preparation

ISO 27001 Annex A 5.25: Assessment and decision on information security events

ISO 27001 Annex A 5.26: Response to information security incidents

ISO 27001 Annex A 5.27: Learning from information security incidents

ISO 27001 Annex A 5.28: Collection of evidence

ISO 27001 Annex A 5.29: Information security during disruption

ISO 27001 Annex A 5.30: ICT readiness for business continuity

ISO 27001 Annex A 5.31: Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.32: Intellectual property rights

ISO 27001 Annex A 5.33: Protection of records

ISO 27001 Annex A 5.34: Privacy and protection of PII

ISO 27001 Annex A 5.35: Independent review of information security

ISO 27001 Annex A 5.36: Compliance with policies and standards for information security

ISO 27001 Annex A 5.37: Documented operating procedures

ISO 27001 Technical Controls

ISO 27001 Annex A 8.1: User Endpoint Devices

ISO 27001 Annex A 8.2: Privileged Access Rights

ISO 27001 Annex A 8.3: Information Access Restriction

ISO 27001 Annex A 8.4: Access To Source Code

ISO 27001 Annex A 8.5: Secure Authentication

ISO 27001 Annex A 8.6: Capacity Management

ISO 27001 Annex A 8.7: Protection Against Malware

ISO 27001 Annex A 8.8: Management of Technical Vulnerabilities

ISO 27001 Annex A 8.9: Configuration Management 

ISO 27001 Annex A 8.10: Information Deletion

ISO 27001 Annex A 8.11: Data Masking

ISO 27001 Annex A 8.12: Data Leakage Prevention

ISO 27001 Annex A 8.13: Information Backup

ISO 27001 Annex A 8.14: Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.15: Logging

ISO 27001 Annex A 8.16: Monitoring Activities

ISO 27001 Annex A 8.17: Clock Synchronisation

ISO 27001 Annex A 8.18: Use of Privileged Utility Programs

ISO 27001 Annex A 8.19: Installation of Software on Operational Systems

ISO 27001 Annex A 8.20: Network Security

ISO 27001 Annex A 8.21: Security of Network Services

ISO 27001 Annex A 8.22: Segregation of Networks

ISO 27001 Annex A 8.23: Web Filtering

ISO 27001 Annex A 8.24: Use of Cryptography

ISO 27001 Annex A 8.25: Secure Development Life Cycle

ISO 27001 Annex A 8.26: Application Security Requirements

ISO 27001 Annex A 8.27: Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.28: Secure Coding

ISO 27001 Annex A 8.29: Security Testing in Development and Acceptance

ISO 27001 Annex A 8.30: Outsourced Development

ISO 27001 Annex A 8.31: Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.32: Change Management

ISO 27001 Annex A 8.33: Test Information

ISO 27001 Annex A 8.34: Protection of information systems during audit testing

Home / ISO 27001 Annex A Controls / ISO 27001:2022 Annex A 5.35 Independent Review Of Information Security

ISO 27001:2022 Annex A 5.35 Independent Review Of Information Security

Last updated Sep 24, 2025

Author: Stuart Barker | ISO 27001 Expert and Thought Leader

What is it?

ISO 27001 Annex A 5.35 Independent review of information security is an ISO 27001 control that wants you to get an independent review of your information security management and controls at planned intervals or when things change significantly.

Why is it important?

The purpose of ISO 27001 Annex A 5.35 Independent review of information security is to ensure that what you are doing is still suitable, adequate and effective.

It is independent so that you do not mark your own homework or become complacent in your operations.

What is the definition in the standard?

The ISO 27001 standard defines ISO 27001 Annex A 5.35 as:

The organisations approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur. 

ISO 27001:2022 Annex A 5.35 Independent review of information security

How do you implement it?

1. Put in place policies and processes for reviews

You will have policy and process for independent reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.

For the process of independent review and audit you can learn the exact process by reading How to Conduct an Internal Audit.

2. Plan your reviews

You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.

3. Fix it if things have gone wrong

Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.

Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.

Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.

For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action

4. Make sure the reviewer is independent

Independence can be achieved using internal or external persons as long as they are independent of the area being reviewed. The people should have the competence to do the review and not have authority over the area being reviewed.

5. Send Report to Management

Independent reviews are reported to management and to top management as appropriate. Using the mechanism of the Management Review Team and the Management Review Team meeting is a great way to report out. Following the structured management review team agenda as defined by the standard.

When do you conduct independent reviews?

In addition to the planned periodic independent reviews there are other times that you would consider conducting independent reviews. They could be when

  • Laws change
  • Regulations change
  • You start a new business venture
  • You change business practice
  • You enter a new jurisdiction
  • Your security controls change

What other standards apply?

ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews. 

ISO 27001 Audit Template

The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct an independent review from the templates, reports, detailed step by step guides and audit work sheets.

Toolkit Icons ISO 27001 Gap Analysis and Audit Toolkit Black

How can the ISO 27001 toolkit help?

The ISO 27001 toolkit is a collection of pre-made documents, templates, and guides. It’s like a shortcut to getting certified! It can save you hundreds of hours by providing

ISO 27001 Toolkit

ISO 27001 Annex A 5.35 FAQ

What are the Benefits of ISO 27001 5.35 Independent review of information security?

Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.35 Independent review of information security: 
You cannot get ISO 27001 certification without it.
Improved security: You will have an effective information security implementation that has been independently checked and verified
Reduced risk: You will reduce the information security risks by having an independent review and implementing any continual improvements
Improved compliance: Standards and regulations require you to have an independent review
Reputation Protection: In the event of a breach having an independent review process in place will reduce the potential for fines and reduce the PR impact of an event

Why is ISO 27001 Annex A 5.35 Independent review of information security important?

Independent reviews are important as they give an impartial view of your information security management systems and controls. They bring fresh eyes, not constrained by day to day operations. Using competent people can lead to significant continual improvements that increase your information security posture.

ISO 27001 Annex A 5.36 Compliance With Policies, Rules And Standards For Information Security

ISO 27001 Controls and Attribute values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
Preventive
Availability
Confidentiality
Integrity
Identify
Protect
Information protection
Governance and ecosystem

About the author

Stuart Barker is an information security practitioner of over 30 years. He holds an MSc in Software and Systems Security and an undergraduate degree in Software Engineering. He is an ISO 27001 expert and thought leader holding both ISO 27001 Lead Implementer and ISO 27001 Lead Auditor qualifications. In 2010 he started his first cyber security consulting business that he sold in 2018. He worked for over a decade for GE, leading a data governance team across Europe and since then has gone on to deliver hundreds of client engagements and audits.

He regularly mentors and trains professionals on information security and runs a successful ISO 27001 YouTube channel where he shows people how they can implement ISO 27001 themselves. He is passionate that knowledge should not be hoarded and brought to market the first of its kind online ISO 27001 store for all the tools and templates people need when they want to do it themselves.

In his personal life he is an active and a hobbyist kickboxer.

His specialisms are ISO 27001 and SOC 2 and his niche is start up and early stage business.