Table of contents
- What is it?
- Why is it important?
- What is the definition in the standard?
- How do you implement it?
- Who does the review?
- When do you conduct reviews?
- What other standards apply?
- ISO 27001 Audit Templates
- How can the ISO 27001 toolkit help?
- ISO 27001 Annex A 5.36 FAQ
- Further Reading
- ISO 27001 Controls and Attribute values
What is it?
ISO 27001 Annex A 5.36 compliance with policies, rules and standards for information security is an ISO 27001 control that wants you to ensure that you are compliant with the information security policy, topic specific policies, rules and standards that you have defined and that it is reviewed regularly.
Why is it important?
The purpose of ISO 27001 Annex A 5.36 Compliance with policies, rules and standards for information security is to ensure that what you are doing is still suitable, adequate and effective.
What is the definition in the standard?
The ISO 27001 standard defines ISO 27001 Annex A 5.36 as:
Compliance with the organisations information security policy, topic-specific policies, rules and standards should be regularly reviewed.
ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security
How do you implement it?
This control compliments ISO 27001 Annex A 5.35 Independent Review of Information Security.
1. Put in place policies and processes for reviews
You will have policy and process for reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.
For the process of review and audit you can learn the exact process by reading How to Conduct an Internal Audit.
2. Plan your reviews
You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.
3. Fix it if things have gone wrong
Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.
Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.
Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.
For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action
4. Keep reports and records
It is important for evidence that is happened to maintain records and reports of the reviews.
Who does the review?
The review can be conducted by:
- The manager of the area where the process is being operated
- The audit team
- The information security manager
- A third party consultant
When do you conduct reviews?
The reviews are done at least annually and if anything changes. Examples of things that change that would lead to a review include:
- Laws change
- Regulations change
- You start a new business venture
- You change business practice
- You enter a new jurisdiction
- Your security controls change
What other standards apply?
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.
ISO 27001 Audit Templates
The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct a review from the templates, reports, detailed step by step guides and audit work sheets.
How can the ISO 27001 toolkit help?
The ISO 27001 toolkit is a collection of pre-made documents, templates, and guides. It’s like a shortcut to getting certified! It can save you hundreds of hours by providing you with the framework you need to create your own procedures, policies, and records.
ISO 27001 Annex A 5.36 FAQ
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001 Annex A 5.36 Compliance with policies, rules and standards for information security:
You cannot get ISO 27001 certification without it.
Improved security: You will have an effective information security implementation that has been checked and verified by those operating it
Reduced risk: You will reduce the information security risks by having a review and implementing any continual improvements
Improved compliance: Standards and regulations require you to have an ongoing reviews process
Reputation Protection: In the event of a breach having a review process in place will reduce the potential for fines and reduce the PR impact of an event
Reviews are important as they give a view of your information security management systems and controls. They can lead to significant continual improvements that increase your information security posture.
Further Reading
The complete guide to ISO 27001 risk assessment
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability Confidentiality Integrity | Identify Protect | Legal_and_compliance Information security assurance | Governance and ecosystem |
