Annex A 5.35 verified ISO/IEC 27001:2022
Independent review of information security
Ensure independent reviews of information security management at regular intervals or after significant changes.
record_voice_over
Plain language
This control is about making sure an outside or independent party checks how a business protects its information. It matters because without these checks, businesses may overlook serious issues that could lead to data breaches, which harm customers and damage trust.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
18 May 2026
Maturity levels
N/A
Official control statement
The organisation's approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.
verified ISO/IEC 27001:2022 Annex A 5.35
priority_high
Why it matters
Without independent reviews, organisations can miss security control weaknesses and drift from policy, increasing breach and disruption risk.
settings
Operational notes
Plan independent reviews at set intervals and after major change; assign independent reviewers, manage conflicts, record findings and track corrective actions.
02 - Implement
build
Implementation tips
- The IT manager should arrange for an independent review of the organisation's information security. This can be done by hiring an external auditor or appointing an internal team not involved in the day-to-day security tasks to conduct the review. The review should assess the security measures in place and suggest improvements.
- Senior management should schedule regular independent reviews, ideally each year, and when any major changes occur like using new technology. This could involve setting up a calendar event for these reviews and ensuring the budget includes funding for hiring external reviewers if necessary.
- HR should ensure that anyone conducting these reviews is not in a position of authority over the security team. HR might need to hire external consultants or assign someone from a different department with the right skills to perform the review.
- The board should ensure that findings from the independent reviews are taken seriously and acted upon. This means reviewing the results, discussing them in board meetings, and making decisions based on the recommendations provided by the reviewers.
- The compliance officer should ensure the review process adheres to relevant regulations like the Privacy Act 1988 in Australia. They should be familiar with these regulations to advise on mandatory reporting of any compliance issues found during the reviews.
03 - Audit
fact_check
Audit / evidence tips
- AskThe schedule of planned independent reviews within the organisation
- GoodA clear timeline showing regular reviews, ideally annually or after significant changes
- AskTo see the independent review reports from the last two years
- GoodComprehensive reports with clear findings and actionable recommendations
- AskWho conducted the most recent independent review and check their credentials
- GoodEvidence that the reviewer is unaffiliated with daily security tasks or decisions, such as an external consultant
- AskHow management responded to the findings of the independent reviews
- GoodClear records of actions taken to rectify issues found during reviews
- AskAbout changes made to information security practices following a significant incident
- GoodTimely adjustments backed by independent review findings ensuring improved security post-incident
04 - Mappings
link
Cross-framework mappings
How Annex A 5.35 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ASD ISM
| Control | Notes | Details |
|---|---|---|
| layers Partially meets (3) expand_less | ||
| ISM-1570 | ISM-1570 requires that outsourced cloud service providers undergo an independent IRAP assessment against the latest ISM release at least ... | |
| ISM-1793 | ISM-1793 requires an independent IRAP assessment of managed service providers and their services at least every 24 months, using the late... | |
| ISM-1971 | ISM-1971 requires TOP SECRET managed service providers and services to undergo an ASD-led security assessment at least every 24 months us... | |
| sync_alt Partially overlaps (6) expand_less | ||
| ISM-0718 | ISM-0718 requires the CISO to regularly report cyber security matters directly to the board or executive committee | |
| ISM-1037 | ISM-1037 requires gateways to be tested after configuration changes and at least every six months to confirm they meet expected security ... | |
| ISM-1587 | ISM-1587 requires system owners to report the security status of each system to the system’s authorising officer at least annually | |
| ISM-1617 | Annex A 5.35 requires an independent review of the organisation’s information security approach and its implementation at planned interva... | |
| ISM-1918 | ISM-1918 requires the CISO to report regularly on cybersecurity matters to the organisation’s audit, risk and compliance committee | |
| ISM-1967 | Annex A 5.35 requires independent review of the organisation’s information security approach and its implementation at planned intervals ... | |
| handshake Supports (13) expand_less | ||
| ISM-0009 | ISM-0009 requires system owners and authorising officers to determine supplementary controls needed for each system given its unique risk... | |
| ISM-0027 | ISM-0027 requires system owners to obtain an authorisation to operate from an authorising officer, creating a formal accountability for r... | |
| ISM-0724 | ISM-0724 requires the CISO to implement cyber security measurement metrics and KPIs to track cyber security performance across the organi... | |
| ISM-0725 | ISM-0725 requires the CISO to coordinate cyber security and business alignment via a formal, regularly meeting cyber security steering co... | |
| ISM-0726 | ISM-0726 requires the CISO to coordinate security risk management activities between cyber security and business teams | |
| ISM-0732 | ISM-0732 requires that the CISO receives and manages a dedicated cyber security budget for the organisation | |
| ISM-1478 | ISM-1478 requires CISO oversight of the cyber security program and assurance of compliance with cyber security obligations | |
| ISM-1523 | ISM-1523 requires a three‑monthly assessment of sampled CDS security-relevant events against data transfer policies to detect operational... | |
| ISM-1998 | ISM-1998 requires the board or executive committee to ensure cyber security is integrated across business functions and remains effective... | |
| ISM-1999 | ISM-1999 requires leadership to align the cyber security strategy with the organisation’s strategic direction and business strategy | |
| ISM-2000 | ISM-2000 requires executives to receive regular briefings on cyber security posture and the threat environment from subject matter experts | |
| ISM-2002 | ISM-2002 requires the board or executive committee to maintain cyber security literacy sufficient for governance and regulatory compliance | |
| ISM-2005 | ISM-2005 requires executives to understand how critical systems are protected and how that protection is verified | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.