Compliance with policies, rules and standards for information security
How well the organization keeps to its security policy and to its topic policies, rules and standards is to be checked regularly.
What the requirement asks
How well the organization keeps to its security policy and to its topic policies, rules and standards is to be checked regularly. Purpose: confirm that security is put in place and operated the way the top policy and the topic policies, rules and standards demand. Guidance: managers and owners of services, products or information work out how to check that what the policies, rules, standards and any applicable regulations require is actually happening, and should consider automated measurement and reporting tools to make regular review efficient. When non-compliance is found they identify its causes, assess whether corrective action is needed, implement suitable action, and review that action to confirm it worked and to spot any remaining weaknesses. The results of reviews and corrective actions are recorded and the records kept, and managers pass them to independent reviewers (5.35) when an independent review covers their area. Corrective actions are completed promptly in proportion to risk, and any not finished by the next scheduled review are at least followed up there. Monitoring how systems are used day to day falls under 8.15 to 8.17. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.
What the guidance adds
Compliance checking is expected to be planned and recorded. The guidance asks for the policy set, the check, the sample, the finding and the follow-up.
Status of the guidance. The guidance lens for 5.36 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep A compliance review plan identifying which managers or owners review which policies, rules and standards and how often and one live sample together.
Evidence an assessor asks for
- Compliance reviewA compliance review plan identifying which managers or owners review which policies, rules and standards and how often
- Compliance reviewCompliance review results, including output from automated measurement or configuration compliance tools
- Compliance reviewNon-compliance records with root causes, corrective actions, owners and target dates
- Compliance reviewEvidence that corrective actions were reviewed for effectiveness
- Compliance reviewRecords showing results were supplied to independent reviewers when an independent review covered the area
- Compliance reviewTracking of overdue corrective actions at the next scheduled review
The question an assessor will ask
An assessor will ask for A compliance review plan identifying which managers or owners review which policies, rules and standards and how often, then trace it to the system it protects. For A.5.36 the test is whether that record ties to a live sample, not whether the control is named in a policy.
Common gaps
- Compliance checks are left entirely to the security team rather than line managers and owners
- Non-compliances are fixed without identifying causes, so they recur
- Corrective actions slip indefinitely with no follow-up
- Technical standards such as hardening baselines are never measured against actual configurations
Before the next audit
Before the next audit, check one live sample for this gap: compliance checks are left entirely to the security team rather than line managers and owners.