Control A.5.35Independent review of information security
What it means in practice
The organisation’s approach to managing information security and its implementation — including people, processes and technologies — must be reviewed independently at planned intervals or when significant changes occur.
Independence is the whole content of the control. The review must be by someone not responsible for what is being reviewed, which may be internal audit, another function, or an external party.
It is distinct from clause 9.2’s internal audit, though the two can be planned together. The internal audit tests conformity with the standard and the organisation’s own requirements; this control asks the broader question of whether the approach itself is sound.
The trigger “or when significant changes occur” is the one that gets overlooked. An acquisition, a new business line, a change of technology platform or a major incident each change what a review would conclude, and an annual cycle can leave a substantial change unreviewed for most of a year — which is precisely the period in which it is least understood.
How to put this in place
People who built a control are poor judges of it. An independent view tells management whether security is working and where it is not.
- Decide who reviews: an internal audit function, a contracted auditor or a peer from another department.
- Confirm they have not built or run what they review.
- Plan reviews at set intervals and after major change.
- Report results to top management.
- Track actions to closure.
Evidence an auditor usually looks for: review or audit reports, evidence of the reviewer's independence, and actions tracked to closure.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
ISMS Internal Audit Programme & Procedure
in ISO 27001 Implementation & Certification ReadinessCovers planning the internal audit programme with auditors independent of the area audited. - Word
Internal Security Assessment Procedure
in Security Maturity & Internal AssessmentIts Framework References list this control. Supported by: Who may assess what; when to commission an independent assessment; the planned cycle and triggers (MA-14, MA-17). - Word
Control Testing Methodology
in Security Control AssuranceIts Framework References list this control. Supported by: Independence and workpaper review (CA-10, CA-11); results that an independent review can use. - Excel
Annual Control Testing Plan
in Security Control AssuranceIts Framework References list this control. Supported by: The plan as a whole: control tests at planned intervals by a tester independent of the control, whose results can feed the independent review. The plan is not that review (CA-18). - Word
Readiness Assessment Procedure
in SOC 2 Report ReadinessIts Framework References list this control. Supported by: Review by someone independent of those who run the controls, which the assessor's role reflects.