A.5.35
Independent review of information security
Organizational controlsCheckpoints 6Evidence 6Cases 6
Control objective
This control requires the organization's approach to managing information security (policies, processes, procedures, controls) and its actual implementation to be reviewed by a party independent of the operation and responsibility of the area under review, at planned intervals and when significant changes occur. Its purpose is to reduce the bias and blind spots that arise when an organization assesses itself, and to confirm from an objective standpoint that the information security approach remains suitable, adequate, and effective in operation. The results and shortcomings identified must be reported to management and translated into improvement activities, thereby supporting the credibility and continual improvement of the management system.
Key checkpoints
- Are plans and procedures in place so that independent reviews of the information security approach and its implementation are performed at planned intervals and when significant organizational, technical, or regulatory changes occur?
- Is the party performing the review (internal audit function, a separate unit, an external specialist body) independent of the operation and responsibility of the subject under review, and does it have the necessary competence (qualifications/experience)?
- Does the review scope cover the documentation framework (policies/procedures), the design and implementation of technical and organizational controls, and actual operational compliance?
- Are the review results, identified shortcomings, and improvement recommendations documented, reported to management, and kept as records?
- Are the improvement items from the review translated into action plans with assigned owners and deadlines, and is their implementation tracked and verified?
- Are the actions taken on findings raised in a previous review, and whether they recur, confirmed in subsequent reviews?
Implementation guidance
- Set the independent review cadence according to risk, internal policy, and applicable obligations. Include triggers for additional reviews following reorganization, major incidents, new regulation, or significant system changes.
- Position the reviewer independently of the operation and responsibility of the area being reviewed, using an internal audit function, a separate unit, or an external specialist body, and confirm the reviewer's competence and absence of conflicts of interest in advance.
- Include in the review scope the adequacy of policies/guidelines/procedures, the design and actual implementation of controls, whether risk assessment/treatment results are reflected, and compliance with legal/contractual requirements, and clearly define the target systems/units/processes.
- Perform the review on an evidence basis by combining document review, interviews with staff, on-site verification, sampling of logs/records, and technical checks where necessary, recording the basis and risk level for each finding.
- Compile the results into a report containing findings, risk levels, and improvement recommendations, report it to management (the information security officer/top management), and feed it into management system improvement and the management review as an input.
- For each improvement recommendation, establish an action plan with an assigned owner and deadline, track progress and completion, and re-confirm the effectiveness of completed actions in a subsequent review.
- Retain review plans/reports/action histories as records so that it can be demonstrated that the reviews were actually performed independently and periodically and led to improvement.
Evidence
- Independent review plan (including cadence, target scope, reviewing party, trigger criteria)
- Basis confirming the reviewing party's independence/competence (internal audit charter, external body contract/qualification material)
- Independent information security review reports (including findings, risk levels, improvement recommendations)
- Records of reporting review results to management and of feeding them into the management review
- Action plans (owner/deadline) for improvement recommendations and their implementation/completion tracking records
- Records of the actions taken on prior review findings and their re-confirmation in subsequent reviews
Nonconformity examples
- No plan/procedure exists for performing independent reviews of the information security approach and implementation, so reviews are conducted only arbitrarily and irregularly.
- The review is performed by the very unit that operates and is responsible for the area under review, so independence is not ensured.
- Despite significant changes such as reorganization, a major security incident, or a major system change, no review is performed in response.
- The review only checks whether documents exist, and so fails to confirm the actual implementation of controls and operational compliance.
- Shortcomings are identified in the review but are not connected to management reporting or action plans, so no improvement takes place.
- Findings raised in a previous review are not confirmed in a subsequent review, so the same issue recurs.