Compliance with policies, rules and standards for information security

Plain-language summary

Checking regularly that the organisation actually follows its own information security policy, topic-specific policies, rules and standards — managers reviewing their own areas, technical checks of systems — and correcting what the checks find.

What the clause is really asking

Policies that nobody checks drift into fiction. This control asks that compliance with your information security policy, topic-specific policies, rules and standards is reviewed regularly. Managers, service owners and information owners should be able to show that their areas follow the rules, identify and evaluate any non-compliance, and take corrective action, with results recorded and reported. Systems should be checked against technical standards too, using automated tools where possible: configuration baselines, patch levels, access rights, encryption settings. The difference from 5.35 is who looks: 5.35 is independent review, while 5.36 is the regular checking done by those responsible for each area, supported by the security function. The common misunderstanding is that the annual internal audit covers it. An audit samples; this control expects ongoing checking between audits. The link to ISO 27001 clause 9.2 is direct: compliance checks feed the audit programme, and audit findings show where the checks are weak. An ISO 9001 or IATF 16949 practitioner will recognise layered process audits and management walk-rounds, and the same habit works here.

What auditors look for

Auditors ask how management knows the policies are followed, then pick two or three — access control, clear desk, acceptable use, patching — and ask for the last compliance check on each. They look for checklists, automated reports such as vulnerability scans or configuration compliance dashboards, and the actions raised. They walk the floor to test clear desk and screen locking themselves, and compare what they see with your own check results. The hard question: when your own checks found someone not following a policy, what happened?

Typical evidence

Compliance check schedule assigning policies and areas to owners; completed manager checklists; automated compliance reports such as vulnerability scans, patch status, configuration baselines and access reviews; non-compliance log with evaluation and corrective actions; reports to management; links between compliance check results and the internal audit programme.

How to comply — recommendations

Draw up a compliance check calendar: each policy, who checks it, how and how often. Give department managers a one-page quarterly checklist for their area — clear desk, screen lock, their staff's access rights, visitors, information handling. Set up automated reports for the technical standards: monthly patch and vulnerability status, configuration drift, privileged accounts. Log every non-compliance with a cause and an action, and escalate repeats. Summarise results for management review and use them to decide where internal audits look next. The free Qlause ISO 27001 Gap Analysis Checklist gives a first baseline, and the Qlause Audit Manager can record checks, findings and actions.

Common nonconformities

No regular review of compliance with information security policies; managers unaware they are responsible for checking their areas; technical compliance not checked against defined standards; non-compliance found but not recorded or acted on; repeated non-compliance with no escalation; compliance results not reported to management; reliance on the annual internal audit alone.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• ArticleHow to write an ISO 9001 audit nonconformity that won't get thrown out
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free downloadNC Writing ChecklistWrite audit nonconformities that hold: requirement, evidence, statement — in that order, checked before the finding is issued.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.