ISO 27001 Annex A 5.36 Review compliance with information security policies
What it says
Compliance with the organization's information security policy, topic-specific policies, rules and standards shall be regularly reviewed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check if your organisation's security policies and rules are being followed.
This control is about checking regularly to make sure your organisation is following its own information security rules and standards. If this isn't done, there might be security weaknesses that could lead to data breaches or compliance issues with laws like the Privacy Act 1988.
Free. Save your status, tasks and notes.
Why it matters
Without regular compliance reviews, staff may not follow the organisation's security policies and standards, increasing audit nonconformities and security incidents.
How to implement
The IT manager should organise regular reviews to ensure compliance with the organisation's security policies.
They can do this by scheduling monthly checks where they compare current practices with the standards set in the policy documents. This can involve using software tools that automatically report on security compliance.
Department heads should ensure that their teams understand and follow the organisation's information security policies.
This can be done by conducting training sessions and quizzes to reinforce the rules and standards applicable to their roles, referencing the Privacy Act 1988 to emphasise compliance requirements.
The HR department should maintain up-to-date records of all compliance training completed by employees.
This involves tracking employee participation in security awareness programs and making sure everyone attends refresher courses at least annually.
The compliance officer should work to identify causes of any non-compliance and implement corrective actions as soon as they are found.
This can be done by investigating reported discrepancies, understanding their root causes, and collaborating with relevant managers to fix these issues.
The board should ensure that there is an independent review process in place, as recommended by ISO 27002:2022, to oversee the effectiveness of the compliance checks.
This involves appointing an external party to periodically audit the organisation's adherence to its own policies.
Keep it running
Schedule quarterly compliance reviews against the organisation's information security and topic-specific policies; sample evidence (logs, approvals, training) and track corrective actions to closure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the most recent compliance review report.
Look at
Check the report for evidence of non-compliance areas and the actions taken to address them.
Good evidence
The report should show clear methods of review and documented corrective actions with timelines and responsibilities.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the schedule of compliance reviews.
Look at
Verify that the reviews are planned and carried out regularly, as per the schedule.
Good evidence
The schedule should indicate regular review intervals, such as monthly or quarterly, with records showing these reviews were completed on time.
- Check 3 of 5What an auditor asks for
Ask for
Request records of training and awareness sessions.
Look at
Confirm that all employees have attended security training relevant to their roles.
Good evidence
There should be a full attendance record for all staff, showing repeated training could indicate effectiveness.
- Check 4 of 5What an auditor asks for
Ask for
Inquire about the process for dealing with non-compliance.
Look at
Look at any logs or records showing identified issues, corrective actions, and their resolution.
Good evidence
A detailed log with timely follow-up and satisfactory resolution for each issue indicates effective compliance management.
- Check 5 of 5What an auditor asks for
Ask for
Request a report from an independent review, if one has been conducted recently.
Look at
Examine the findings and recommendations for improvements.
Good evidence
The independent review should confirm adherence to policies and suggest areas of improvement, showing external objectivity.
Mappings
Closest match in ASD Information Security Manual: ISM-1037, Regular testing of gateway security configurations, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.2.4.
Annex A 2.4 requires scheduled (and event-driven) review of the AI policy to ensure it remains effective. Annex A 5.36 requires regular review of compliance with information security policies, which can include checking adherence to AI-related security requirements embedded in policy. Annex A 2.4 focuses on policy suitability/adequacy/effectiveness, whereas Annex A 5.36 focuses on whether the organisation is complying with policies (which may not, by itself, validate that the policy remains fit for purpose).
ASD Information Security Manual: 8 mappings
This control is broader than ISM-1037.
ISM-1037 requires gateways to be tested after changes and at least every six months to validate conformance to expected security configurations. Annex A 5.36 requires regular review of compliance with information security policies, rules and standards, which can be evidenced by periodic technical configuration conformance testing of gateways. ISM-1037 is a technical, gateway-specific compliance validation mechanism with a defined frequency, while Annex A 5.36 is broader and can be performed through non-technical governance reviews as well.
This control is broader than ISM-1523.
ISM-1523 requires a three‑monthly review of a sample of CDS security-relevant events against data transfer security policies to identify operational failures. Annex A 5.36 requires regular reviews of compliance with the organisation's information security policies, topic-specific policies, rules and standards, which can include transfer policies and operational monitoring outputs. ISM-1523 is a specific, prescriptive compliance review method (event sampling for CDS transfers) that would sit within the broader compliance-review expectation of Annex A 5.36.
This control partially overlaps ISM-0072.
Annex A 5.36 requires organisations to regularly review compliance with information security policies, rules and standards. ISM-0072 requires security requirements in service provider contracts to be documented and reviewed regularly to ensure they remain fit for purpose, which overlaps with reviewing adherence to security requirements (a type of standard/requirement). ISM-0072 is narrower and supplier-specific and emphasises fitness-for-purpose of contractual requirements, while Annex A 5.36 is organisation-wide and focused on compliance with internal policy and standards.
This control partially overlaps ISM-0718.
ISM-0718 mandates regular cyber security reporting by the CISO to the board. Annex A 5.36 requires reviews of compliance with information security policies, the results of which are typically included in board-level updates. Annex A 5.36 focuses on policy compliance, while ISM-0718 emphasizes governance communication and accountability.
This control partially overlaps ISM-1478.
Annex A 5.36 requires organisations to regularly review compliance with information security policies, rules and standards. ISM-1478 requires the CISO to oversee the cyber security program and ensure organisational compliance with cyber security policy, standards, regulations and legislation, which includes monitoring and assurance activities aligned to compliance review. ISM-1478 is broader in governance scope (covering legal/regulatory compliance and overall program oversight), whereas Annex A 5.36 is specifically focused on the recurring review of adherence to internal information security policy and related rules/standards.
This control partially overlaps ISM-1738.
Annex A 5.36 requires organisations to regularly review compliance with information security policies, rules and standards. ISM-1738 requires exercising the right to verify service provider compliance with security requirements in contracts, which is a concrete form of compliance verification in a supplier context. ISM-1738 is narrower (third-party contractual compliance verification), while Annex A 5.36 is broader and includes internal policy compliance across the organisation.
- ISM-1971ASD-led security assessment of TOP SECRET managed services every 24 monthsPartially overlaps
This control partially overlaps ISM-1971.
ISM-1971 mandates periodic ASD security assessments for TOP SECRET managed services, providing formal assurance against the ISM baseline. ISO/IEC 27001:2022 Annex A 5.36 requires regular review of compliance with information security policies, rules and standards, which overlaps with using assessments/audits to verify compliance. Annex A 5.36 can be satisfied by internal or external reviews across all policies, whereas ISM-1971 is specifically an ASD (or delegate) assessment focused on TOP SECRET managed services and ISM conformance on a defined 24-month cycle.
This control supports ISM-1078.
Annex A 5.36 requires regular review of compliance with the organisation's information security policies, topic-specific policies, rules and standards. ISM-1078 requires a telephone system usage policy to be developed, implemented and maintained, providing defined rules against which compliance can be reviewed under Annex A 5.36. ISM-1078 is policy creation/maintenance for one topic, while Annex A 5.36 is the recurring compliance review mechanism.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.3Detect and remediate configuration drift using scheduled assessments and automated monitoringBroader than
This control is broader than IT.PRO-04.3.
IT.PRO-04.3 requires scheduled technical assessments and, where supported, automated monitoring to detect and respond to configuration drift, scaled to system criticality and change rate. These assessments are a technical form of the regular compliance review required by Annex A 5.36, checking systems against the organisation's approved configuration standards and correcting deviations. Annex A 5.36 is broader, covering compliance with the information security policy, topic-specific policies, rules and standards as a whole rather than configuration baselines alone.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.
Need this as a written policy?
PolicyMint drafts the ISO 27001 documentation this control expects, customised to your business and checked by three independent verifiers before you see it. Not a boilerplate template you have to fight into shape. First document free.
Draft your ISO 27001 documentation