5.35 Independent review of information security
How the organization manages information security, and how that is carried out through people, processes and technology, is to be examined by someone independent on a planned cycle and whenever a significant change occurs. Purpose: keep the way information security is managed suitable, adequate and effective over time. Guidance: have processes for independent review, which management plans and initiates periodically. Reviews assess improvement opportunities and whether the approach needs changing, covering the top-level policy, the topic policies and the other controls. Reviewers are independent of the area reviewed (for example internal audit, a manager from elsewhere or a specialist external firm), competent, and outside the line of authority for that area. Results go to the management that commissioned the review and, where appropriate, to top management, and records are kept. Where a review finds the approach or implementation inadequate, for example objectives and requirements not met or practice not in line with the policies (5.1), management starts corrective action. Beyond the periodic cycle, consider an independent review when relevant laws and regulations change, after significant incidents, when a new business is started or an existing one changes, when a product or service is newly adopted or used differently, and when security controls and procedures change substantially. Guidance on conducting such reviews is in ISO/IEC 27007 and in ISO/IEC TS 27008.
Source: ISO/IEC 27002:2022, 5.35. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Review reports by reviewers independent of the area, with evidence of their competence and independence · HR system / LMS
- Reports of results to the commissioning management and to top management where appropriate · Document repository
- Records of event-driven reviews triggered by legal change, significant incidents, new business or services, or major control changes · Document repository
governing documentDocuments that govern the control
- A management-approved programme of periodic independent reviews of information security · Document repository
- Corrective action plans raised from review findings and evidence of their completion · Policy repository / GRC workspace
First move
Common gaps auditors find
- Reviews are carried out by staff who report into the area being reviewed
- Reviews happen only on a fixed schedule and are not triggered by significant change
- Findings are reported but no corrective action is initiated
- Reviewers lack information security competence, so reviews are superficial
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.34 Privacy and protection of PII · 5.36 Compliance with policies, rules and standards for information security