Control A.5.35Independent review of information security
The organisation’s approach to managing information security and its implementation — including people, processes and technologies — must be reviewed independently at planned intervals or when significant changes occur.
Independence is the whole content of the control. The review must be by someone not responsible for what is being reviewed, which may be internal audit, another function, or an external party.
It is distinct from clause 9.2’s internal audit, though the two can be planned together. The internal audit tests conformity with the standard and the organisation’s own requirements; this control asks the broader question of whether the approach itself is sound.
The trigger “or when significant changes occur” is the one that gets overlooked. An acquisition, a new business line, a change of technology platform or a major incident each change what a review would conclude, and an annual cycle can leave a substantial change unreviewed for most of a year — which is precisely the period in which it is least understood.
How to put this in place
People who built a control are poor judges of it. An independent view tells management whether security is working and where it is not.
- Decide who reviews: an internal audit function, a contracted auditor or a peer from another department.
- Confirm they have not built or run what they review.
- Plan reviews at set intervals and after major change.
- Report results to top management.
- Track actions to closure.
Evidence an auditor usually looks for: review or audit reports, evidence of the reviewer's independence, and actions tracked to closure.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
ISMS Internal Audit Programme & ProcedureWord
Covers planning the internal audit programme with auditors independent of the area audited.