ISO 27002:2022 Clause 5.36 Compliance with policies, rules and standards for information security
In this article I lay bare ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security.
Using over two decades of experience on hundreds of ISO 27001 audits and ISO 27001 certifications I am going to show you what’s new, give you templates, show you examples and do a walkthrough.
In this ISO 27001 certification guide I show you exactly what changed in the ISO 27001:2022 update.
I am Stuart Barker the ISO 27001 Ninja and this is ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security.
Table of contents
- ISO 27002:2022 Clause 5.36 Compliance with policies, rules and standards for information security
- What is ISO 27001 Compliance with policies, rules and standards for information security?
- ISO 27001 Implementation Guide: Compliance with policies, rules and standards for information security
- ISO 27001 Compliance with policies, rules and standards for information security Templates
- What are the Benefits of ISO 27001 5.36 Compliance with policies, rules and standards for information security?
- Why is ISO 27001 Annex A 5.36 Compliance with policies, rules and standards for information security important?
- Matrix of ISO 27001:2022 Controls and ISO 27001:2022 Attribute values
- Reference
What is ISO 27001 Compliance with policies, rules and standards for information security?
ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security is an ISO 27002:2022 control that wants you to ensure that you are compliant with the information security policy, topic specific policies, rules and standards that you have defined and that it is reviewed regularly.
What is the purpose of ISO 27001:2022 Annex 5.36?
The purpose of ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security is to ensure that what you are doing is still suitable, adequate and effective.
What is the definition of ISO 27001:2022 Annex 5.36?
The ISO 27001:2022 standard defines ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security as:
Compliance with the organisations information security policy, topic-specific policies, rules and standards should be regularly reviewed.
ISO 27001:2022 Annex A 5.36
ISO 27001 Implementation Guide: Compliance with policies, rules and standards for information security
This control compliments ISO 27001:2022 Annex A 5.35 Independent Review of Information Security.
Process of review
You will have policy and process for reviews. Consider the guidance in ISO 27001:2022 Clause 9.2 Internal audit.
For the process of review and audit you can learn the exact process by reading How to Conduct an Internal Audit.
Plan your reviews
You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.
Continual Improvement
Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.
Consider the guidance in ISO 27001:2022 Clause 10.1 Continual Improvement.
Who does the review
Independence is not required for 5.36 but it covered under ISO 27001:2022 Annex A 5.35 Independent Review of Information Security.
It is acceptable for the reviews to be conducted by managers, service, product or information owners.
The use of automatic reporting and measuring tools is also acceptable. See the controls 8.15, 8.16 and 8.17.
Reports and records
It is important for evidence that is happened to maintain records and reports of the reviews.
Corrective Actions
Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.
For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action
When to conduct reviews
In addition to the planned periodic reviews there are other times that you would consider conducting reviews. They could be when
- Laws change
- Regulations change
- You start a new business venture
- You change business practice
- You enter a new jurisdiction
- Your security controls change
Other applicable standards
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.
FREE 30 minute ISO 27001 strategy session.
Claim your 100% FREE no-obligation 30 minute strategy session call (£1000 value). This is strictly for small businesses who are hungry to get ISO 27001 certified up to 10x faster and 30x cheaper.
ISO 27001 Compliance with policies, rules and standards for information security Templates
The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct a review from the templates, reports, detailed step by step guides and audit work sheets.
Having an ISO 27001 template for control 5.36 can help fast track your implementation. The ISO 27001 Document Toolkit is a the ultimate resource for your ISO 27001 implementation including all the documents and templates that you need for Annex A 5.36 and ISO 27001 certification.
Do it yourself
SAVE over £10,000
What are the Benefits of ISO 27001 5.36 Compliance with policies, rules and standards for information security?
Other than your ISO 27001 certification requiring it, the following are the top 5 benefits of ISO 27001:2022 Annex A 5.36 Compliance with policies, rules and standards for information security:
- You cannot get ISO 27001 certification without it.
- Improved security: You will have an effective information security implementation that has been checked and verified by those operating it
- Reduced risk: You will reduce the information security risks by having a review and implementing any continual improvements
- Improved compliance: Standards and regulations require you to have an ongoing reviews process
- Reputation Protection: In the event of a breach having a review process in place will reduce the potential for fines and reduce the PR impact of an event
Why is ISO 27001 Annex A 5.36 Compliance with policies, rules and standards for information security important?
Reviews are important as they give a view of your information security management systems and controls. They can lead to significant continual improvements that increase your information security posture.
Matrix of ISO 27001:2022 Controls and ISO 27001:2022 Attribute values
Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
#Preventive | #Availability #Confidentiality #Integrity | #Identify #Protect | #Legal_and_compliance #Information_security_assurance | #Governance_and_ecosystem |