ISO 27001 A.5.36 - Compliance with Policies, Rules and Standards for Information Security

Requirement

“Compliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed.”

Plain-language meaning

The organization must regularly check whether people, processes, and systems comply with its information security policies, rules, standards, and technical implementation requirements.

Why this matters

Policies and standards are useless if nobody checks whether they are followed. Regular compliance review finds drift, weak enforcement, misconfigured systems, repeated nonconformities, and control failures before they become incidents or audit findings.

Implementation guidance

1. Define management compliance reviews for each area of responsibility, using formal reviews, spot checks, or both.
2. Define technical compliance checks for systems, networks, servers, cloud platforms, firewalls, endpoints, and other information systems based on risk.
3. Ensure technical checks are performed only by competent and authorized people, especially where testing tools, vulnerability scanners, or penetration testing are used.
4. Control security testing tools so unauthorized use is prevented and suspicious use is handled as a security incident.
5. Plan and document review scope, frequency, methods, responsible reviewers, tools, authorization, and expected evidence.
6. Record results, nonconformities, root causes, corrective actions, follow-up checks, and effectiveness evidence.
7. Look for similar issues in other systems or areas when one nonconformity is found.
8. Report management review results into internal review, management review, or other governance reporting routes.

Audit guidance

Auditors should verify that management and technical compliance reviews are planned, risk-based, documented, authorized, performed by competent personnel, and traceable from findings to corrective action and effectiveness checks. They should sample both managerial policy compliance and technical conformity evidence.

Evidence examples

Strong evidence

• Compliance review plan covers policies, rules, standards, management areas, technical systems, frequency, method, and owner.
• Management reviews or spot checks show policy compliance in each area of responsibility.
• Technical compliance checks cover relevant systems and are performed by competent authorized personnel.
• Testing tools are controlled, approved, and scoped to prevent misuse or accidental testing of wrong systems.
• Findings trace to root cause, corrective action, implementation evidence, and effectiveness verification.
• Patterns are reviewed to find similar issues elsewhere.

Weak evidence

• Compliance review is only an annual attestation.
• Technical checks are informal and not risk-based.
• Scanning or testing tools are available to unauthorized users.
• Findings are tracked in spreadsheets without closure evidence.
• Root cause is not analyzed and similar issues are not checked elsewhere.
• Managers cannot show how they review compliance in their own areas.

Common failures

Exam traps

• A.5.36 is about regular compliance review against policies, rules, and standards.
• Manager reviews and technical checks are both relevant.
• Technical compliance testing must be authorized and competent because it can disrupt systems or create legal risk.
• Findings should trace to root cause, corrective action, follow-up, and effectiveness.
• One nonconformity should prompt consideration of similar issues elsewhere.

Related controls and concepts

• Information Security Policy
• Policy Review Checklist
• Internal Audit
• Corrective Action Tracker
• Management Review
• A.5.35 Independent Review of Information Security
• A.5.37 Documented Operating Procedures

KB-ready summary

A.5.36 is part of the assurance and operations governance layer. The practical test is whether the organization can show planned review, controlled work, competent owners, documented evidence, traceable findings, and corrective action where the process does not work.

Templates and checklists

• Policy and Technical Compliance Review Register
• Technical Compliance Review Plan
• A.5.36 Audit Checklist