Independent review of information security

Plain-language summary

Having the organisation's approach to information security — its policies, processes, people and technology — reviewed by someone independent of the area, at planned intervals and after significant changes, so management hears an unbiased view of whether it works.

What the clause is really asking

The people who build and run security controls are poor judges of them, and this control asks for an outside view. Someone independent should examine how you manage information security and how well that is put into practice — people, processes and technology — on a planned cycle and again whenever something significant changes. Independent means the reviewer does not report to, or review their own work in, the area concerned: an internal audit function, a manager from another department, or an external party such as a consultant or penetration tester. Management should initiate the reviews, receive the results, and see that corrective actions follow. Triggers for an extra review include a reorganisation, a major new system, an acquisition or a serious incident. The common misunderstanding is that the certification audit satisfies this. It does not; the certification body samples for its own purpose, not as your management's review. In practice the ISO 27001 clause 9.2 internal audit programme is the main vehicle, supplemented by technical assessments. In an integrated management system the same audit programme and auditor pool can cover ISO 9001 and ISO 27001.

What auditors look for

Auditors ask for the internal audit programme and reports, and check the reviewers' independence: did anyone audit their own work or their manager's area? They look for coverage of the whole ISMS over the cycle, including the applicable Annex A controls, and for external reviews such as penetration tests. They check that results reached top management and that findings became corrective actions with closure evidence. They ask whether a significant change in the past year triggered a review. The hard question: who reviewed the work of the information security manager, and what did they find?

Typical evidence

Independent review or internal audit programme covering the ISMS; reviewer competence and independence records; audit and review reports; external assessments such as penetration tests or consultant reviews; management review minutes showing results discussed; corrective action records arising from findings; records of reviews triggered by significant change.

How to comply — recommendations

Plan an internal audit programme that covers every ISMS clause and every applicable Annex A control over a three-year cycle, weighted towards high-risk areas, and have someone outside the security function audit the information security manager's own processes. Train two or three internal auditors from other departments, or use an external auditor where you lack independence. Add an external technical test, such as a penetration test, every year or after major changes. Report results to top management and track findings as corrective actions to closure. The Qlause Audit Manager can hold the programme, checklists, findings and actions in one place.

Common nonconformities

No independent review of the ISMS; internal auditors auditing their own work; audit programme not covering all clauses and applicable controls over the cycle; significant changes not triggering a review; review results not reported to top management; findings without corrective actions or closure; certification audit treated as the independent review.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.