EXAM-015 - Assurance, Compliance, and Operating Procedures

Topic Summary

These controls close the A.5 organizational control set by checking whether the ISMS is independently reviewed, whether policies and standards are followed, and whether operating procedures are controlled and available.

Key Concepts

Common Exam Traps

• Thinking independent review must always be external.
• Treating policy review as the same as compliance review.
• Letting unauthorized people run technical testing tools.
• Closing findings without retest or effectiveness evidence.
• Assuming experienced operators remove the need for documented procedures.

Related Notes

• A.5.35 Independent Review of Information Security
• A.5.36 Compliance with Policies, Rules and Standards for Information Security
• A.5.37 Documented Operating Procedures
• Independent Information Security Review Plan and Report
• Policy and Technical Compliance Review Register
• Operating Procedure Register