5.35 Independent review of information security
Requires the organisation's approach to managing information security, and its implementation across people, processes and technologies, to be reviewed independently at planned intervals and whenever significant change o
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Reports from reviews performed in the period, and the identity and independence of the reviewer · Document repository
- Evidence of independence, meaning the reviewer does not review their own work · Document repository
- Findings raised, their management responses and evidence of completed remediation · Document repository
- Records of reviews triggered by significant change, in addition to those on the planned cycle · Document repository
governing documentDocuments that govern the control
- The plan for independent review, showing the interval and the scope covering approach, people, processes and technologies · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Review performed by the information security manager on their own management system, which is not independent
- Scope limited to technical testing, so the approach to managing security is never itself reviewed
- Findings accepted with no remediation and no formal risk acceptance
- No review triggered by significant change, so a major restructure or migration is only picked up at the next annual cycle
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.34 Privacy and protection of PII · 5.36 Compliance with policies, rules and standards for information security