Introduction
I am going to show you what ISO 27001 Annex A 5.35 Independent Review Of Information Security is, what’s new, give you ISO 27001 templates, an ISO 27001 toolkit, show you examples, do a walkthrough and show you how to implement it.
I am Stuart Barker the ISO 27001 Ninja and using over 30 years experience on hundreds of ISO 27001 audits and ISO 27001 certifications I show you exactly what changed in the ISO 27001 update and exactly what you need to do for ISO 27001 certification.
Table of contents
- Introduction
- ISO 27001 Independent Review Of Information Security
- Process of independent review
- Plan your reviews
- Continual Improvement
- Independent Persons
- Reports to Management
- Corrective Actions
- When to conduct independent reviews
- Other applicable standards
- Tutorial Video
- ISO 27001 Audit Template
- FAQ
- Related ISO 27001 Controls
- Further Reading
- ISO 27001 Controls and Attribute values
ISO 27001 Independent Review Of Information Security
ISO 27001 Annex A 5.35 Independent review of information security is an ISO 27001 control that wants you to get an independent review of your information security management and controls at planned intervals or when things change significantly.
Purpose
The purpose of ISO 27001 Annex A 5.35 Independent review of information security is to ensure that what you are doing is still suitable, adequate and effective.
It is independent so that you do not mark your own homework or become complacent in your operations.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 5.35 as:
The organisations approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur.
ISO 27001:2022 Annex A 5.35 Independent review of information security
Process of independent review
You will have policy and process for independent reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.
For the process of independent review and audit you can learn the exact process by reading How to Conduct an Internal Audit.
Plan your reviews
You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.
Continual Improvement
Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.
Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.
Independent Persons
Independence can be achieved using internal or external persons as long as they are independent of the area being reviewed. The people should have the competence to do the review and not have authority over the area being reviewed.
Reports to Management
Independent reviews are reported to management and to top management as appropriate. Using the mechanism of the Management Review Team and the Management Review Team meeting is a great way to report out. Following the structured management review team agenda as defined by the standard.
Corrective Actions
Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.
For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action
When to conduct independent reviews
In addition to the planned periodic independent reviews there are other times that you would consider conducting independent reviews. They could be when
- Laws change
- Regulations change
- You start a new business venture
- You change business practice
- You enter a new jurisdiction
- Your security controls change
Other applicable standards
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.
Tutorial Video
ISO 27001 Audit Template
The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct an independent review from the templates, reports, detailed step by step guides and audit work sheets.
Having an ISO 27001 template for control 5.35 can help fast track your implementation. The ISO 27001 Toolkit is a the ultimate resource for your ISO 27001 implementation including all the documents and templates that you need for Annex A 5.35 and ISO 27001 certification.
FAQ
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.35 Independent review of information security:
You cannot get ISO 27001 certification without it.
Improved security: You will have an effective information security implementation that has been independently checked and verified
Reduced risk: You will reduce the information security risks by having an independent review and implementing any continual improvements
Improved compliance: Standards and regulations require you to have an independent review
Reputation Protection: In the event of a breach having an independent review process in place will reduce the potential for fines and reduce the PR impact of an event
Independent reviews are important as they give an impartial view of your information security management systems and controls. They bring fresh eyes, not constrained by day to day operations. Using competent people can lead to significant continual improvements that increase your information security posture.
Related ISO 27001 Controls
ISO 27001 Compliance With Policies, Rules And Standards For Information Security: Annex A 5.36
Further Reading
The complete guide to ISO/IEC 27002:2022
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability Confidentiality Integrity | Identify Protect | Information protection | Governance and ecosystem |
