BrowseToolsGuidesComparePricingStacksPlaybooksBlogSearch
ComplianceReadiness checkISO 27001ISO 42001SOC 2PCI DSSPolicy templatesControl mapCompliance softwareFramework compare
A.5.36A.5 Organizational controls

Compliance with policies, rules and standards

A.5EVIDENCEA.6EVIDENCEA.7EVIDENCEA.8EVIDENCECONTROL MAPA.5.36 Evidence MapPOLICY / CONTROL / EVIDENCE / REVIEW

Purpose

Regularly review compliance with your information security policy, topic-specific policies, rules and standards.

How to meet this control

In short: Regularly review compliance with your own security policies and standards.

  1. Step 01Have managers and asset owners define how they verify their area meets policy and standards
  2. Step 02Use automated compliance measurement and reporting (configuration scanning, GRC dashboards) for efficient regular checks
  3. Step 03Track policy exceptions formally with a documented justification, compensating control and expiry date
  4. Step 04Identify the cause of any non-compliance and implement and verify corrective actions
  5. Step 05Record review results and corrective actions and complete them in a timeframe matching the risk

Tip: Track policy exceptions formally with expiry dates.

What ISO 27002 says to cover

Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.

  • ›Have managers and information owners define how they will check that security requirements are met
  • ›Use automated measurement and reporting tools for efficient regular reviews
  • ›When non-compliance is found, identify its causes
  • ›Evaluate the need for corrective actions and implement appropriate ones
  • ›Review corrective actions to confirm they worked and find any remaining weaknesses
  • ›Record review results and corrective actions and keep those records
  • ›Complete corrective actions in a timeframe matching the risk

Audit evidence to keep

  • - Records of regular compliance reviews against policies and standards
  • - Policy exception register with justifications, compensating controls and expiry dates
  • - Corrective action records for non-compliances with verification of effectiveness
  • - Automated compliance or configuration reports where used

Common mistakes

  • - Writing a policy but not operating the process
  • - Keeping evidence in personal folders where auditors cannot trace it
  • - Letting exceptions stay open with no owner or expiry date

Owner, cadence, and proof

Assign one accountable owner for A.5.36. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.

Policy templates for this control

Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.

AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Data retention and disposal policyUse for ISO 27001 A.5.33, A.5.34, A.8.10, SOC 2 Confidentiality and Privacy, and PCI DSS requirement 3.
Open the control-to-policy map
← A.5.35 Independent review of information securityA.5.37 Documented operating procedures →
Back to all organizational controls or see the requirements (clauses 4 to 10). To run this control with automation, read how AI manages controls.