ISO 27001 A.5.35 - Independent Review of Information Security

Requirement

“The organization’s approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.”

Plain-language meaning

The organization must have its information security management approach and actual implementation independently reviewed at planned intervals and when significant changes happen.

Why this matters

Security teams can become blind to their own weaknesses. Independent review gives management objective assurance that the ISMS, controls, people, processes, and technologies remain suitable and effective.

Implementation guidance

1. Define the independent review schedule, scope, criteria, and reporting route to management.
2. Define triggers for supplementary reviews, such as major planned change, major unplanned change, serious incident, merger, outsourcing change, cloud migration, regulatory change, or major control failure.
3. Ensure reviewer independence. The reviewer can be internal if hierarchically independent from the area reviewed, or external where internal independence is not practical.
4. Record review results, conclusions, findings, recommendations, management decisions, and corrective actions.
5. Track corrective actions to completion and verify whether they had the intended effect.
6. Feed independent review results into management review, risk assessment, internal audit planning, and improvement activities.

Audit guidance

Auditors should verify that independent reviews occur as planned, are triggered by significant changes where required, are performed by independent competent reviewers, are reported to management, and result in recorded corrective actions that are completed and effective.

Evidence examples

Strong evidence

• Independent review schedule defines scope, frequency, reviewer independence, criteria, and reporting route.
• Review records cover people, processes, technologies, ISMS approach, and implementation evidence.
• Supplementary review triggers are linked to change and incident management processes.
• Reviewer independence is documented and appropriate for the scope.
• Findings are tracked to corrective actions, owners, due dates, closure evidence, and effectiveness checks.
• Results are reported to management and considered in management review.

Weak evidence

• Security team reviews its own implementation without independence.
• Reviews happen only before certification audit.
• Major changes occur without supplementary review.
• Findings are recorded but not tracked to closure.
• Corrective actions are closed without effectiveness evidence.
• Management does not receive or act on review results.

Common failures

Exam traps

• A.5.35 can be satisfied by internal review if the reviewer is independent from the reviewed scope.
• A third-party certification audit can satisfy this control if suitable and scoped appropriately.
• The review covers the approach to managing information security and implementation across people, processes, and technologies.
• Reviews happen at planned intervals and when significant changes occur.
• Findings should produce recorded corrective actions and effectiveness checks.

Related controls and concepts

• Internal Audit
• Management Review
• Corrective Action Tracker
• A.5.36 Compliance with Policies, Rules and Standards for Information Security
• Risk Assessment
• A.5.24 Information Security Incident Management Planning and Preparation

KB-ready summary

A.5.35 is part of the assurance and operations governance layer. The practical test is whether the organization can show planned review, controlled work, competent owners, documented evidence, traceable findings, and corrective action where the process does not work.

Templates and checklists

• Independent Information Security Review Plan and Report
• A.5.35 Audit Checklist