ISO 27001 Annex A 5.35 Independent review of information security
What it says
The organization's approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure independent reviews of information security management at regular intervals or after significant changes.
This control is about making sure an outside or independent party checks how a business protects its information. It matters because without these checks, businesses may overlook serious issues that could lead to data breaches, which harm customers and damage trust.
Free. Save your status, tasks and notes.
Why it matters
Without independent reviews, organisations can miss security control weaknesses and drift from policy, increasing breach and disruption risk.
How to implement
The IT manager should arrange for an independent review of the organisation's information security.
This can be done by hiring an external auditor or appointing an internal team not involved in the day-to-day security tasks to conduct the review. The review should assess the security measures in place and suggest improvements.
Senior management should schedule regular independent reviews, ideally each year, and when any major changes occur like using new technology.
This could involve setting up a calendar event for these reviews and ensuring the budget includes funding for hiring external reviewers if necessary.
HR should ensure that anyone conducting these reviews is not in a position of authority over the security team.
HR might need to hire external consultants or assign someone from a different department with the right skills to perform the review.
The board should ensure that findings from the independent reviews are taken seriously and acted upon.
This means reviewing the results, discussing them in board meetings, and making decisions based on the recommendations provided by the reviewers.
The compliance officer should ensure the review process adheres to relevant regulations like the Privacy Act 1988 in Australia.
They should be familiar with these regulations to advise on mandatory reporting of any compliance issues found during the reviews.
Keep it running
Plan independent reviews at set intervals and after major change; assign independent reviewers, manage conflicts, record findings and track corrective actions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The schedule of planned independent reviews within the organisation.
Look at
The frequency and timing of the reviews listed in the schedule.
Good evidence
A clear timeline showing regular reviews, ideally annually or after significant changes.
- Check 2 of 5What an auditor asks for
Ask for
To see the independent review reports from the last two years.
Look at
The contents of the reports to ensure they cover the entire information security process, including policies and technical measures.
Good evidence
Comprehensive reports with clear findings and actionable recommendations.
- Check 3 of 5What an auditor asks for
Ask for
Who conducted the most recent independent review and check their credentials.
Look at
Evidence demonstrating their independence from the information security operations.
Good evidence
Evidence that the reviewer is unaffiliated with daily security tasks or decisions, such as an external consultant.
- Check 4 of 5What an auditor asks for
Ask for
How management responded to the findings of the independent reviews.
Look at
The documented actions taken in response to recommendations.
Good evidence
Clear records of actions taken to rectify issues found during reviews.
- Check 5 of 5What an auditor asks for
Ask for
About changes made to information security practices following a significant incident.
Look at
Documentation detailing these adjustments and the timeline for implementation.
Good evidence
Timely adjustments backed by independent review findings ensuring improved security post-incident.
Mappings
Closest match in ASD Information Security Manual: ISM-0100, Regular IRAP assessment of sensitive gateways, which this control covers in full and more.
ASD Information Security Manual: 12 mappings
This control is broader than ISM-0100.
ISM-0100 requires non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways to undergo an IRAP assessment against a current ISM release at least every 24 months. An IRAP assessment is an independent review of how security is implemented for the gateway, so it is a specific instance of the independent review of information security required by Annex A 5.35. Annex A 5.35 applies to the organisation's whole approach to managing information security (people, processes and technologies) at planned intervals or after significant change, whereas ISM-0100 is limited to gateways and sets a fixed maximum interval.
This control is broader than ISM-1793.
ISM-1793 requires an independent IRAP assessment of managed service providers and their services at least every 24 months, using the latest ISM release available prior to assessment. Annex A 5.35 requires independent review of the organisation's information security approach and implementation at planned intervals or upon significant change, which is a broader assurance requirement. ISM-1793 is a specific instantiation of independent review limited to MSPs/managed services and tied to IRAP and ISM versioning/cadence.
This control is broader than ISM-1972.
ISM-1972 requires outsourced TOP SECRET cloud service providers and their services to undergo an ASD-led (or delegate-led) ISM security control assessment at least every 24 months using the current ISM baseline. ISO/IEC 27001:2022 Annex A 5.35 requires the organisation's information security approach and its implementation to be independently reviewed at planned intervals or after significant change, which aligns to the assurance concept of independent review. ISM-1972 is a more prescriptive and sector-specific instantiation (TOP SECRET cloud, ASD assessors, 24-month cycle, ISM baseline) of the broader independent review requirement in Annex A 5.35.
This control is broader than ISM-2019.
ISM-2019 requires TOP SECRET gateways to undergo an independent security control assessment by ASD (or delegates) at least every 24 months using a current ISM release. This aligns with ISO/IEC 27001:2022 Annex A 5.35, which requires independent reviews of the organisation's information security approach and its implementation at planned intervals. ISM-2019 is a more prescriptive, high-assurance instantiation of independent review, specifying assessor type (ASD), assessment baseline (latest ISM) and a fixed periodicity for a specific system class (TOP SECRET gateways).
This control partially overlaps ISM-1037.
ISM-1037 requires gateways to be tested after configuration changes and at least every six months to confirm they meet expected security configurations. Annex A 5.35 requires independent reviews at planned intervals or when significant changes occur, which overlaps with ISM-1037's trigger-based and periodic assurance concept for gateways. ISM-1037 is specifically about technical testing of gateway configurations and prescribes a maximum interval, whereas Annex A 5.35 is organisation-wide and emphasises independence rather than a particular technical test cadence.
This control partially overlaps ISM-1563.
ISM-1563 requires producing a security assessment report documenting scope, control effectiveness, risks and remediation. ISO/IEC 27001:2022 Annex A 5.35 overlaps as it involves documenting findings, weaknesses and improvement actions from an independent review of information security. While ISM-1563 is focused on a system security control assessment, Annex A 5.35 has a broader governance emphasis.
This control partially overlaps ISM-1587.
ISM-1587 requires system owners to report the security status of each system to the system's authorising officer at least annually. Annex A 5.35 requires an independent review of the organisation's information security approach and its implementation at planned intervals or on significant change, which can produce evidence and findings that feed into an annual system security status report under ISM-1587. The overlap is in assurance and periodic governance reporting, but Annex A 5.35 emphasises independence and organisation-wide review, while ISM-1587 focuses on system-level status reporting to the authorising officer.
This control partially overlaps ISM-1617.
Annex A 5.35 requires an independent review of the organisation's information security approach and its implementation at planned intervals or after significant change. ISM-1617 relates by requiring the CISO to regularly review and update the cyber security program to keep it relevant to threats and opportunities. Both address periodic review, but ISM-1617 does not require independence and is focused on program maintenance rather than independent assurance over the full ISMS implementation.
This control partially overlaps ISM-1636.
ISM-1636 requires a security control assessment of each system and its operating environment by organisational assessors or IRAP to confirm controls are implemented correctly and operating as intended. ISO/IEC 27001:2022 Annex A 5.35 relates by requiring independent review of the organisation's information security approach and its implementation at planned intervals or when significant changes occur. Annex A 5.35 is broader at the governance/program level, while ISM-1636 is more specific to system-by-system control assessments tied to authorisation and Australian classification contexts.
This control partially overlaps ISM-1918.
ISM-1918 requires the CISO to report regularly on cybersecurity matters to the organisation's audit, risk and compliance committee. Annex A 5.35 involves independent review activities, leading to reporting to governance bodies such as an audit committee. The overlap lies in the governance assurance and reporting aspect; however, Annex A 5.35 is about the execution of independent reviews, contrasting ISM-1918's emphasis on CISO's executive reporting.
This control partially overlaps ISM-1967.
Annex A 5.35 requires independent review of the organisation's information security approach and its implementation at planned intervals or after significant change. ISM-1967 overlaps by mandating a security assessment by ASD assessors (or delegates) for TOP SECRET systems to determine whether controls are implemented correctly and operating as intended, which is a form of independent assurance. ISM-1967 is narrower in scope (TOP SECRET systems and control effectiveness testing) whereas Annex A 5.35 covers the organisation-wide management approach and implementation beyond specific classified systems.
This control supports ISM-1564.
ISM-1564 requires the system owner to produce a plan of action and milestones at the conclusion of a security control assessment for a system. The plan relies on an independent assessment having been performed, which aligns with the Annex A 5.35 requirement for independent review of information security at planned intervals or after significant change. Annex A 5.35 covers the organisation's overall approach to information security, while ISM-1564 addresses the remediation plan that follows a system-level assessment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation