UnixTime

Research Note

ISO27001-A.5.36 Compliance with Policies, Rules and Standards for Information Security

  • Updated Jun 06, 2026
  • Read 01 min read
  • Status reviewed

The organization must regularly check whether people, processes, and systems comply with its information security policies, rules, standards, and technical implementation requirements.

On this page

Control Purpose

The organization must regularly check whether people, processes, and systems comply with its information security policies, rules, standards, and technical implementation requirements.

Use A.5.36 Compliance with Policies, Rules and Standards for Information Security for the detailed requirement, implementation guidance, audit checks, evidence expectations, and related ISO 27005 context.

Risk Logic

01 Policy or operation
02 Weak review/procedure control
03 Drift or nonconformity
04 Security impact
05 Compliance with Policies, Rules and Standards for Information Security
06 Evidence
07 Audit

No published risk scenario is linked to this control yet. Create or link a risk note under the risk knowledge base before treating this control as fully mapped.

Detailed Note

Evidence Required

Map this control to governance assurance, control effectiveness, operational failure, nonconformity, and corrective action risk.

Software Architecture Mapping

Relevant objects: control, review, procedure, compliance_check, evidence, finding, corrective_action.

Audit Questions

  • AQ-ISO27001-A.5.36 Audit Question
  • How does the organization prove ISO27001-A.5.36 is implemented and operating?
  • What evidence shows ownership, review cadence, exceptions, and corrective action?
  • Which failed condition would create an audit finding for this control?
  • Iso27001
  • ISO27002
  • Annex a
  • Control
  • Governance

Note Metadata

Aliases: ISO27001-A.5.36

Source: 06-Control-Knowledge-Base/ISO27001-A.5.36-Compliance-with-Policies-Rules-and-Standards-for-Information-Security.md

Control dependency map

How this control connects to work products

Generated from the static research graph. It shows navigation and evidence dependencies; it is not an audit conclusion.

4

links

Control

ISO27001-A.5.36 Compliance with Policies, Rules and Standards for Information Security
01

Requirement context

Primary control text, framework notes, or adjacent controls this note points to.

02

Evidence required

Evidence packs and proof records that support auditability.

03

Audit checks

Audit questions, checklists, or review material connected to the control.

Graph-sourced resources

Templates and evidence

Implementer templates

Working artifacts for control owners and operators.

Auditor evidence packs

Evidence collections and audit-facing verification material.