Control A.5.36Compliance with policies, rules and standards for information security
Compliance with the organisation’s information security policy, topic-specific policies, rules and standards must be regularly reviewed.
The internal-facing counterpart to A.5.31: not “which laws apply to us” but “are we doing what we said we would do”.
The review is expected to be regular and to reach the people who operate the controls, and it is most useful where it examines practice rather than documentation. Asking whether a policy exists tests the library; asking whether access reviews happened, exceptions were approved, and changes followed the process tests the organisation.
Managers are the natural reviewers for their own areas, and that creates an obvious limitation which independent review under A.5.35 and internal audit under clause 9.2 exist to offset.
What matters most is what follows a finding. Where non-compliance is recorded and nothing changes, the review becomes a ritual and its records become evidence that the organisation knew.
How to put this in place
Policies that are written but not followed give false comfort. Regular checks find drift before an auditor does.
- Decide which checks managers and the ISMS manager will run, such as configuration checks, access reviews and procedure spot checks.
- Put them on a schedule.
- Record the results.
- Find the cause of each non-adherence, fix it and record the fix.
- Handle justified deviations as approved exceptions in a register.
Evidence an auditor usually looks for: compliance check records, the exception register, and actions taken on non-adherence.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists records of compliance checks and approved exceptions among the documents auditors commonly expect for this control.