A.5.36 Compliance with policies, rules and standards for information security

Control objective

This control requires the organization to periodically verify that the information security policies, topic-specific policies, rules, and standards it has established are actually being complied with in day-to-day operations and system administration, and to identify and correct instances of non-compliance. It calls for managers and staff to check compliance within their areas of responsibility, to verify technical compliance of system configuration/settings through automated or manual means, and to link any deviations found to root-cause analysis and improvement. The ultimate aim is to ensure that policies do not exist only on paper but operate effectively in practice, and to sustain the ongoing suitability of the management system.

Key checkpoints

Do managers/owners periodically check compliance with information security policies, rules, and standards within their areas of responsibility?
Is technical compliance of system configuration, security settings, and access rights verified using automated tools or manual checks?
Are the scope, frequency, method, and owner of the checks defined as a procedure, and are the results recorded and reported?
For non-compliance found in checks, are root-cause analysis, corrective action, and recurrence-prevention measures established and implemented?
Are recurring or significant non-compliances escalated to management review and improvement activities (policy revision, training, and so on)?
Are technical compliance checks performed under prior planning/approval and control so they do not adversely affect operational systems?

Implementation guidance

Establish a compliance-check plan and checklist that define, for each information security policy/rule/standard, the scope, check items, frequency, method, and owner.
Assign managers the responsibility to periodically self-assess whether their processes/services meet the policies and standards, and keep records of the results.
Verify technical compliance of system security configuration/settings against configuration baselines using automated tools (configuration checks, vulnerability scanners) or manual review.
Because technical compliance checks can affect operations, perform them in a controlled manner under prior planning/approval and by qualified personnel, and validate in a test environment where necessary.
Classify non-compliances found by severity, assign root-cause analysis, corrective action, completion deadline, and owner to track them, and confirm that actions are completed.
Analyze recurring/systemic non-compliance to determine whether it stems from the policy or standard being unrealistic or from awareness/competence gaps, and link it to policy revision, training, and process improvement.
Periodically report check results and improvement status to management and relevant functions, and manage them in conjunction with management system inspection and internal audit.

Related controls and attributes

Evidence

Compliance-check plans and checklists for information security policies/rules/standards
Records of manager self-assessments and compliance verification results
Technical compliance check reports (checks against configuration baselines, automated tool scans)
Register of non-compliances and records of corrective action/recurrence prevention
Management reporting on compliance-check results and follow-up improvement items
Basis for improvement activities such as policy revision/training triggered by non-compliance

Nonconformity examples

Information security policies/standards are established, but no checking activity is performed to verify actual compliance.
Compliance checks are done only once at a specific point in time, with no frequency, owner, or method defined as a procedure.
No technical compliance check (verification against security settings/configuration baselines) exists, so system settings drift from the standard.
Non-compliance is found in a check, but it is merely recorded and left unaddressed without root-cause analysis or corrective action.
The same non-compliance recurs, yet it is never linked to fundamental improvement such as policy revision or training.
Technical compliance checks are run on operational systems without prior approval/planning, causing outages or other adverse impact.