In this guide you will learn how to implement ISO 27001 Annex A 5.35 Independent review of information security and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
ISO 27001 Annex A 5.35 is an ISO 27001 control that wants you to get an independent review of your information security management and controls at planned intervals or when things change significantly.
Table of contents
- Purpose & Definition
- FREE ISO 27001 Annex A 5.35 Training Video
- Implementation Guide
- How to implement ISO 27001 Annex A 5.35
- ISO 27001 Templates
- How to Audit ISO 27001 Annex A 5.35
- ISO 27001 Annex A 5.35 Template
- ISO 27001 Annex A 5.35 FAQ
- What other standards apply?
- Related ISO 27001 Controls
- ISO 27001 Controls and Attribute values
- About the author
Purpose & Definition
The purpose of ISO 27001 Annex A 5.35 Independent review of information security is to ensure that what you are doing is still suitable, adequate and effective.
It is independent so that you do not mark your own homework or become complacent in your operations.
The ISO 27001 standard defines ISO 27001 Annex A 5.35 as:
The organisations approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur.
ISO 27001:2022 Annex A 5.35 Independent review of information security
ISO 27001 Starter Kit
Instant download of mandatory ISMS core policies and documentation. Verified by Lead Auditors and used by 5,000+ businesses worldwide to pass Stage 1 certification first time.
FREE ISO 27001 Annex A 5.35 Training Video
In this free training video you will learn How to implement ISO 27001 Independent Review of Information Security (Annex A 5.35) and Pass Your Audit.
Implementation Guide
Process of independent review
You will have policy and process for independent reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.
For the process of independent review and audit you can learn the exact process by reading How to Conduct an Internal Audit.
Plan your reviews
You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.
Make sure the reviewer is independent
Independence can be achieved using internal or external persons as long as they are independent of the area being reviewed. The people should have the competence to do the review and not have authority over the area being reviewed.
Continual Improvement
Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.
Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.
Corrective Actions
Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.
For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action
Send reports to management
Independent reviews are reported to management and to top management as appropriate. Using the mechanism of the Management Review Team and the Management Review Team meeting is a great way to report out. Following the structured management review team agenda as defined by the standard.
When to conduct independent reviews
In addition to the planned periodic independent reviews there are other times that you would consider conducting independent reviews. They could be when
- Laws change
- Regulations change
- You start a new business venture
- You change business practice
- You enter a new jurisdiction
- Your security controls change
How to implement ISO 27001 Annex A 5.35
Implementation of ISO 27001 Annex A 5.35 is essential for maintaining the integrity and objectivity of the Information Security Management System (ISMS). This process involves a systematic evaluation by parties external to the day-to-day security operations, ensuring that controls are both suitable and effective in mitigating organisational risks. By following these technical steps, organisations can identify systemic weaknesses before they result in a breach or a non-conformity during a certification audit.
1. Formalise the Independent Review Schedule
Establish a documented audit programme that defines the scope, frequency, and methodology of reviews to ensure governance remains unbiased.
- Determine the specific business processes, technical systems, and physical locations to be included in the review scope.
- Set a recurring timeline for reviews, typically annually or following significant infrastructure changes.
- Define the criteria for “independence” to ensure reviewers are not auditing their own work or operational responsibilities.
2. Verify Reviewer Competency and Independence
Select internal auditors or external consultants with the necessary technical expertise to provide an objective assessment of the ISMS.
- Confirm the reviewer has a deep understanding of ISO 27001:2022 requirements and relevant technical controls.
- Provision access to necessary documentation and systems for reviewers while maintaining the principle of least privilege.
- Formalise a conflict of interest declaration to document the reviewer’s independence from the security implementation team.
3. Conduct Technical and Operational Assessments
Execute the review through evidence collection and technical verification of security controls and configuration baselines.
- Audit IAM roles and Multi-Factor Authentication (MFA) enforcement to ensure access controls are operating as intended.
- Review system logs, vulnerability scan results, and configuration management databases (CMDB) to verify technical compliance.
- Inspect physical security perimeters and environmental controls to confirm adherence to Annex A 7 requirements.
4. Document Findings in a Comprehensive Audit Report
Generate a formal record of the review results, including non-conformities and opportunities for improvement, to establish a compliance baseline.
- Categorise findings as Major Non-conformities, Minor Non-conformities, or Observations to assist in prioritisation.
- Include specific evidence, such as screenshots or log extracts, to support each identified gap.
- Distribute the final report to the CISO and relevant process owners for immediate review.
5. Execute Remediation and Corrective Actions
Implement a structured Corrective and Preventive Action (CAPA) workflow to resolve identified gaps and strengthen the security posture.
- Assign clear ownership and deadlines for the remediation of each identified non-conformity.
- Update the Risk Register and Statement of Applicability (SoA) based on findings to reflect the current security state.
- Verify the effectiveness of implemented fixes through a follow up review to ensure the risk has been mitigated.
6. Present Results to Management for ISMS Validation
Report the independent findings to the Management Review Board to drive continual improvement and strategic resource allocation.
- Synthesise audit findings into high-level metrics for executive visibility during Management Review Meetings.
- Formalise a management response that outlines the commitment to addressing critical security gaps.
- Maintain records of the review and management actions as mandatory evidence for external certification bodies.
Check Your Work?
You buit it yourself. Maybe with AI. But will it pass the audit?
Don’t gamble – let a trained ISO 27001 auditor check your work.
ISO 27001 Templates
How to Audit ISO 27001 Annex A 5.35
Auditing ISO 27001 Annex A 5.35 requires a technical deep dive into how your organisation validates the effectiveness of its security controls. As a Lead Auditor, I am looking for evidence that goes beyond a simple check-box exercise: I want to see truly independent oversight, rigorous reporting, and executive-level accountability for corrective actions. Use this 10 step technical roadmap to ensure your independent review process is robust enough to withstand a certification audit.
1. Audit the Internal Audit Programme and Policy
Audit the topic-specific policy for independent reviews to confirm it defines the frequency, scope, and methodology of the audit programme: result: establishes the legal and procedural baseline for the ISMS oversight.
- Verify that the programme covers the entire scope of the ISMS and all applicable Annex A controls.
- Check that the audit schedule is risk-based and takes into account previous audit results.
- Confirm the policy is reviewed annually and carries senior management approval.
2. Validate Reviewer Independence and Objectivity
Validate the independence of the assigned reviewers by inspecting organisational reporting lines and conflict of interest declarations: result: ensures that reviewers are not auditing their own work or processes.
- Verify that internal auditors report to a level of management that provides sufficient authority.
- Check that external reviewers have been vetted for technical competence and impartiality.
- Confirm that no member of the IT or Security team is reviewing their own configuration changes.
3. Provision Auditor Access via Restricted IAM Roles
Provision temporary Identity and Access Management (IAM) roles for the reviewer to allow for evidence collection: result: ensures the reviewer has necessary visibility without compromising the Principle of Least Privilege.
- Apply read-only access to configuration files, log repositories, and security dashboards.
- Mandate Multi-Factor Authentication (MFA) for the auditor’s temporary account access.
- Audit the revocation of these access rights immediately upon completion of the review.
4. Formalise the Rules of Engagement for External Reviews
Formalise the Rules of Engagement (ROE) and Non-Disclosure Agreements (NDA) for any third-party reviewers: result: defines legal boundaries and protects organisational data during the audit process.
- Document the technical limitations and “out-of-scope” assets for penetration testing or scans.
- Review the data handling requirements for any evidence exported to the reviewer’s systems.
- Verify the “Right to Audit” clauses in contracts with Managed Service Providers (MSPs).
5. Inspect the Review Scope and Technical Depth
Inspect the audit plan to verify that the review includes technical testing of infrastructure, not just a document review: result: provides assurance that security controls are effective in practice.
- Verify that the review includes a sample of firewall rules, server hardening configurations, and cloud security groups.
- Check for evidence of physical security walk-throughs and social engineering testing.
- Confirm that the review addresses “Significant Changes” in infrastructure since the last audit.
6. Audit the Reporting and Documentation Process
Audit the final audit reports to confirm they are documented in a technical format that includes specific evidence and observations: result: provides a reliable audit trail for certification bodies.
- Ensure each finding is mapped to a specific ISO 27001 control or organisational requirement.
- Check that reports include both non-conformities and “Opportunities for Improvement” (OFI).
- Verify that technical evidence, such as redacted screenshots or log extracts, is appended.
7. Review Management Feedback and Sign-off
Review the management review minutes to verify that independent review findings were presented to the executive board: result: confirms leadership accountability and resource allocation for security.
- Check for documented management responses to high-risk findings.
- Verify that the board has approved the remediation timelines proposed by the technical teams.
- Confirm that systemic security issues are identified and addressed at the governance level.
8. Audit the Corrective Action and Remediation Logs
Audit the Corrective Action Log to track the progress of remediation for all identified security gaps: result: ensures that vulnerabilities are closed and risks are mitigated in a timely manner.
- Verify that every finding has an assigned “Action Owner” and a realistic target date.
- Check for evidence of “Root Cause Analysis” (RCA) for major non-conformities.
- Inspect the progress updates to ensure remediation hasn’t stalled due to lack of resources.
9. Validate the Re-testing of Remediation Actions
Validate that all remediation actions were re-tested by an independent party before being marked as closed: result: prevents the “self-certification” of fixes and ensures vulnerabilities are genuinely resolved.
- Inspect the testing logs to see that a fresh scan or configuration check was performed.
- Verify that the reviewer has signed off on the closure of the finding.
- Check that re-testing is documented with the same rigour as the original audit.
10. Inspect the Update of the Asset Register
Inspect the organisational Asset Register to ensure it has been updated with any new risks or assets discovered during the review: result: maintains the accuracy of the organisational risk landscape.
- Verify that “Shadow IT” or undocumented legacy systems found during the audit are now formally recorded.
- Check that risk owners have updated their departmental registers based on audit findings.
- Confirm that the review results feed directly into the next ISMS risk assessment cycle.
ISO 27001 Annex A 5.35 Template
The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct an independent review from the templates, reports, detailed step by step guides and audit work sheets.
ISO 27001 Annex A 5.35 FAQ
No, while both involve assessment, an independent review is a broader evaluation of the ISMS strategy and governance, whereas an internal audit (Clause 9.2) is a structured check against specific standard requirements.
Independent reviews often focus on the suitability of the security approach for the business goals.
Internal audits are typically more prescriptive and focus on compliance with the ISO 27001 clauses.
Reviews may be performed by external consultants or internal staff who were not involved in the ISMS implementation.
The results of both feed into the Management Review Meeting.
An independent review must be conducted by individuals who have the necessary technical competence and were not involved in developing the security controls being assessed.
External third-party consultants or specialist security firms.
Internal audit departments with no operational responsibility for the ISMS.
Specialised management teams from different departments within the same group.
The key requirement is “independence” from the day-to-day management of the security function.
ISO 27001 requires reviews at “planned intervals” or whenever “significant changes” occur, which typically translates to an annual review for most organisations.
Annual reviews are the industry standard for maintaining certification.
Significant changes include major infrastructure migrations, mergers, or new regulatory requirements.
High-risk environments may require more frequent, targeted reviews (e.g., bi-annually).
The primary triggers for a review include scheduled audit cycles, major security incidents, or substantial shifts in the organisation’s technical or legal landscape.
Planned periodic intervals as defined in the ISMS roadmap.
Following a significant information security breach or system failure.
Major changes to business processes, such as moving to a fully remote work model.
New legislation or industry-specific security standards entering into force.
ISO 27001 does not mandate a specific certification, but the reviewer must be “competent.” As an auditor, I look for relevant experience, such as a background in IT auditing, or professional certifications like CISA (Certified Information Systems Auditor), CISSP, or an ISO 27001 Lead Auditor qualification.
If your MSP is responsible for managing your firewalls, backups, or user access, they absolutely cannot perform the independent review. That is a direct conflict of interest. However, if your MSP has a completely separate, dedicated compliance consulting division that does not touch your operational IT, it may be permissible if strict segregation of duties is documented.
What other standards apply?
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.
Related ISO 27001 Controls
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability Confidentiality Integrity | Identify Protect | Information protection | Governance and ecosystem |
About the author
