In this guide you will learn how to implement ISO 27001 Annex A 5.35 Independent review of information security and pass your audit from ISO 27001 Lead Auditor Stuart Barker – author of the ultimate ISO 27001 Toolkit.
ISO 27001 Annex A 5.35 is an ISO 27001 control that wants you to get an independent review of your information security management and controls at planned intervals or when things change significantly.
Table of contents
Purpose & Definition
The purpose of ISO 27001 Annex A 5.35 Independent review of information security is to ensure that what you are doing is still suitable, adequate and effective.
It is independent so that you do not mark your own homework or become complacent in your operations.
The ISO 27001 standard defines ISO 27001 Annex A 5.35 as:
The organisations approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur.
ISO/IEC 27001:2022 Annex A 5.35 Independent Review Of Information Security
White Label
ISO 27001 for Consultants
Custom-brandable ISO 27001 documentation for consultants. Easily rebrand, reduce project time, and deliver professional, high-value security systems. Focus on delivery, not drafting.
FREE ISO 27001 Annex A 5.35 Training Video
In this free training video you will learn How to implement ISO 27001 Independent Review of Information Security (Annex A 5.35) and Pass Your Audit.
Implementation Guide
Process of independent review
You will have policy and process for independent reviews. Consider the guidance in ISO 27001 Clause 9.2 Internal audit.
For the process of independent review and audit you can learn the exact process by reading How to Conduct an Internal Audit.
Plan your reviews
You will plan your reviews on a periodic basis. There is no real guidance on periodic so plan to do one full audit of everything at least annually. You can implement an audit plan that includes both internal and external audits and reviews.
Make sure the reviewer is independent
Independence can be achieved using internal or external persons as long as they are independent of the area being reviewed. The people should have the competence to do the review and not have authority over the area being reviewed.
Continual Improvement
Opportunities for continual improvement form part of the independent review. Based on the continual improvement policy and process this is an opportunity to identify any needs for change or enhancements.
Consider the guidance in ISO 27001 Clause 10.1 Continual Improvement.
Corrective Actions
Corrective actions may be required and should be implemented if the review finds things not working as intended. You would record it in the incident and corrective action log, potentially in the risk register if there is a risk identified and manage it as part of the corrective action process.
For further guidance refer to ISO 27001:2002 Clause 10.2 Corrective Action
Send reports to management
Independent reviews are reported to management and to top management as appropriate. Using the mechanism of the Management Review Team and the Management Review Team meeting is a great way to report out. Following the structured management review team agenda as defined by the standard.
When to conduct independent reviews
In addition to the planned periodic independent reviews there are other times that you would consider conducting independent reviews. They could be when
- Laws change
- Regulations change
- You start a new business venture
- You change business practice
- You enter a new jurisdiction
- Your security controls change
How to implement ISO 27001 Annex A 5.35
Implementation of ISO 27001 Annex A 5.35 is essential for maintaining the integrity and objectivity of the Information Security Management System (ISMS). This process involves a systematic evaluation by parties external to the day-to-day security operations, ensuring that controls are both suitable and effective in mitigating organisational risks. By following these technical steps, organisations can identify systemic weaknesses before they result in a breach or a non-conformity during a certification audit.
1. Formalise the Independent Review Schedule
Establish a documented audit programme that defines the scope, frequency, and methodology of reviews to ensure governance remains unbiased.
- Determine the specific business processes, technical systems, and physical locations to be included in the review scope.
- Set a recurring timeline for reviews, typically annually or following significant infrastructure changes.
- Define the criteria for “independence” to ensure reviewers are not auditing their own work or operational responsibilities.
2. Verify Reviewer Competency and Independence
Select internal auditors or external consultants with the necessary technical expertise to provide an objective assessment of the ISMS.
- Confirm the reviewer has a deep understanding of ISO 27001:2022 requirements and relevant technical controls.
- Provision access to necessary documentation and systems for reviewers while maintaining the principle of least privilege.
- Formalise a conflict of interest declaration to document the reviewer’s independence from the security implementation team.
3. Conduct Technical and Operational Assessments
Execute the review through evidence collection and technical verification of security controls and configuration baselines.
- Audit IAM roles and Multi-Factor Authentication (MFA) enforcement to ensure access controls are operating as intended.
- Review system logs, vulnerability scan results, and configuration management databases (CMDB) to verify technical compliance.
- Inspect physical security perimeters and environmental controls to confirm adherence to Annex A 7 requirements.
4. Document Findings in a Comprehensive Audit Report
Generate a formal record of the review results, including non-conformities and opportunities for improvement, to establish a compliance baseline.
- Categorise findings as Major Non-conformities, Minor Non-conformities, or Observations to assist in prioritisation.
- Include specific evidence, such as screenshots or log extracts, to support each identified gap.
- Distribute the final report to the CISO and relevant process owners for immediate review.
5. Execute Remediation and Corrective Actions
Implement a structured Corrective and Preventive Action (CAPA) workflow to resolve identified gaps and strengthen the security posture.
- Assign clear ownership and deadlines for the remediation of each identified non-conformity.
- Update the Risk Register and Statement of Applicability (SoA) based on findings to reflect the current security state.
- Verify the effectiveness of implemented fixes through a follow up review to ensure the risk has been mitigated.
6. Present Results to Management for ISMS Validation
Report the independent findings to the Management Review Board to drive continual improvement and strategic resource allocation.
- Synthesise audit findings into high-level metrics for executive visibility during Management Review Meetings.
- Formalise a management response that outlines the commitment to addressing critical security gaps.
- Maintain records of the review and management actions as mandatory evidence for external certification bodies.
Check Your Work?
You built it yourself. Maybe with AI. But will it pass the audit?
Don’t gamble – let an ISO 27001 Lead Auditor check your work.
ISO 27001 Templates
ISO 27001 Annex A 5.35 Template
The ISO 27001 Gap Analysis, Review and Audit Toolkit provides everything you need to conduct an independent review from the templates, reports, detailed step by step guides and audit work sheets.
ISO 27001 Annex A 5.35 FAQ
No, while both involve assessment, an independent review is a broader evaluation of the ISMS strategy and governance, whereas an internal audit (Clause 9.2) is a structured check against specific standard requirements.
Independent reviews often focus on the suitability of the security approach for the business goals.
Internal audits are typically more prescriptive and focus on compliance with the ISO 27001 clauses.
Reviews may be performed by external consultants or internal staff who were not involved in the ISMS implementation.
The results of both feed into the Management Review Meeting.
An independent review must be conducted by individuals who have the necessary technical competence and were not involved in developing the security controls being assessed.
External third-party consultants or specialist security firms.
Internal audit departments with no operational responsibility for the ISMS.
Specialised management teams from different departments within the same group.
The key requirement is “independence” from the day-to-day management of the security function.
ISO 27001 requires reviews at “planned intervals” or whenever “significant changes” occur, which typically translates to an annual review for most organisations.
Annual reviews are the industry standard for maintaining certification.
Significant changes include major infrastructure migrations, mergers, or new regulatory requirements.
High-risk environments may require more frequent, targeted reviews (e.g., bi-annually).
The primary triggers for a review include scheduled audit cycles, major security incidents, or substantial shifts in the organisation’s technical or legal landscape.
Planned periodic intervals as defined in the ISMS roadmap.
Following a significant information security breach or system failure.
Major changes to business processes, such as moving to a fully remote work model.
New legislation or industry-specific security standards entering into force.
ISO 27001 does not mandate a specific certification, but the reviewer must be “competent.” As an auditor, I look for relevant experience, such as a background in IT auditing, or professional certifications like CISA (Certified Information Systems Auditor), CISSP, or an ISO 27001 Lead Auditor qualification.
If your MSP is responsible for managing your firewalls, backups, or user access, they absolutely cannot perform the independent review. That is a direct conflict of interest. However, if your MSP has a completely separate, dedicated compliance consulting division that does not touch your operational IT, it may be permissible if strict segregation of duties is documented.
What other standards apply?
ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.
Related ISO 27001 Controls
ISO 27001 Controls and Attribute values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability Confidentiality Integrity | Identify Protect | Information protection | Governance and ecosystem |
Stuart Barker
I am the ISO 27001 Ninja.
I help tech companies, start-ups, and small businesses implement information security management systems without the corporate bloat or massive consultant fees.
If you want to pass your audit the first time, book a call.
