Independent review of information security
How the organization manages information security, and how that is carried out through people, processes and technology, is to be examined by someone independent on a planned cycle and whenever a significant change occurs.
What the requirement asks
How the organization manages information security, and how that is carried out through people, processes and technology, is to be examined by someone independent on a planned cycle and whenever a significant change occurs. Purpose: keep the way information security is managed suitable, adequate and effective over time. Guidance: have processes for independent review, which management plans and initiates periodically. Reviews assess improvement opportunities and whether the approach needs changing, covering the top-level policy, the topic policies and the other controls. Reviewers are independent of the area reviewed (for example internal audit, a manager from elsewhere or a specialist external firm), competent, and outside the line of authority for that area. Results go to the management that commissioned the review and, where appropriate, to top management, and records are kept. Where a review finds the approach or implementation inadequate, for example objectives and requirements not met or practice not in line with the policies (5.1), management starts corrective action. Beyond the periodic cycle, consider an independent review when relevant laws and regulations change, after significant incidents, when a new business is started or an existing one changes, when a product or service is newly adopted or used differently, and when security controls and procedures change substantially. Guidance on conducting such reviews is in ISO/IEC 27007 and in ISO/IEC TS 27008. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Independent review is expected to be genuinely independent. The guidance asks for the reviewer, the scope, the criteria, the findings and the action taken.
Status of the guidance. The guidance lens for 5.35 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A management-approved programme of periodic independent reviews of information security and one live sample together.
Evidence an assessor asks for
- Independent assuranceA management-approved programme of periodic independent reviews of information security
- Independent assuranceReview reports by reviewers independent of the area, with evidence of their competence and independence
- Independent assuranceReports of results to the commissioning management and to top management where appropriate
- Independent assuranceCorrective action plans raised from review findings and evidence of their completion
- Independent assuranceRecords of event-driven reviews triggered by legal change, significant incidents, new business or services, or major control changes
The question an assessor will ask
An assessor will ask for A management-approved programme of periodic independent reviews of information security, then trace it to the system it protects. For A.5.35 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Reviews are carried out by staff who report into the area being reviewed
- Reviews happen only on a fixed schedule and are not triggered by significant change
- Findings are reported but no corrective action is initiated
- Reviewers lack information security competence, so reviews are superficial
Before the next audit
Before the next audit, check one live sample for this gap: reviews are carried out by staff who report into the area being reviewed.