ISO 27001:2022 Annex A 5.35 – Independent Review of Information Security

Purpose of ISO 27001:2022 Annex A 5.35

Organisations should conduct independent reviews at planned intervals and whenever major operational changes occur, in order to guarantee that their information security management policies remain intact, as per ISO 27001:2022 Annex A Control 5.35 to ensure that:

• They possess the ability to meet the adequate requirements.
• They strive to attain the right objectives.
• Their performance is effective; they function as designed.

Ownership of Annex A 5.35

ISO 27001:2022 Annex A Control 5.35 focuses primarily on operational affairs, so ownership should be held by the Chief Operating Officer (COO) or Chief Information Security Officer (CISO) if one is present.

General Guidance on ISO 27001:2022 Annex A 5.35

The goal of management is to devise and execute procedures which allow for separate reviews of their info security practices.

Reviews should focus on identifying areas for improvement in an organisation’s approach to information security, including:

• Information security policy.
• Policies tailored to specific topics.
• Associated controls.

An individual from outside the organisation with no personal stake in the matter should conduct a review. This could be someone from within the organisation or an independent third party, such as:

• Internal auditors are responsible for assessing the effectiveness of a company’s internal control systems and procedures.
• Independent departmental managers.
• Third-party organisations may be engaged to provide services.

Whoever conducts the review should possess the necessary operational skills to make a valid judgement on their findings. In the case of internal staff, their job role should not restrict them from delivering a justifiable and valid assessment.

The review’s findings should be meticulously logged, retained, and reported to the Managers who requested it, and in some cases to C-level personnel or ownership.

Reviewers should assess whether information security practices are compliant with the organisation’s established objectives and requirements, which are detailed in the information security policy and any topic-specific policies.

Periodic reviews may be supplemented with ad-hoc ones. Five grounds for such reviews can be identified:

1. Any amendments to laws, guidelines or regulations that affect the organisation’s information security operations must be observed.
2. Significant events that have an effect on information security, such as data loss and intrusion, arise.
3. A new venture is established or major transformations are made to the existing business.
4. The company takes on a new product or service that has information security implications or alters an existing product or service.
5. Significant alterations are executed in the organisation’s bank of information security controls, regulations and processes.

Supplementary Guidance on Annex A 5.35

ISO/IEC 27007 and ISO/IEC TS 27008 provide further advice on carrying out independent reviews.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 5.35 replaces ISO 27001:2013 Annex A 18.1.2 (Independent Review of Information Security).

ISO 27001:2022 Annex A 5.35 offers the same general instructions as ISO 27001:2013 Annex A 18.1.2, but goes beyond that to provide specific examples of when an organisation should do ad-hoc assessments in addition to its regular reviews.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

How ISMS.online Help

ISMS.online simplifies and accelerates ISO 27001:2022 implementation through its cloud-based platform. It offers a sophisticated framework for recording information security management system procedures and checklists to guarantee adherence to accepted standards.

By using ISMS.online, you can:

1. Access a comprehensive library of ISO 27001 standards and guidelines;
2. Generate a detailed report of your company’s current security status;
3. Design and implement a security management system that meets your company’s needs;
4. Monitor and review your security systems on an ongoing basis.

Contact us now to arrange a demonstration.