Key takeaways
- Have your security approach reviewed independently at planned intervals.
- An independent view catches blind spots.
- Start here: plan periodic independent reviews of your security approach.
Purpose
Have your security approach reviewed independently at planned intervals.
Requirement
Requirement summaryThe organization’s approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur.
Why it matters
An independent view catches blind spots. Self-assessment alone rarely spots what you take for granted.
How to implement
- Plan periodic independent reviews of your security approach.
- Use internal audit or external assessors who are not responsible for the area reviewed.
- Report results to management.
- Track findings through to resolution.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.35. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your plan for an independent review of your security programme, by someone outside the work being checked.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.35 marked as used or not used, a short reason, and its current status.
Records and examples to show
- The latest independent review or audit report, shared with management.
- Actions from the review and their progress.
Things you should be able to show or explain
- Be able to explain how review results are used.
How much to show: The most recent review.
Common mistakes
- No independent review done.
- Findings ignored.
- Reviews done by the same person who runs the controls.
- Findings with no follow-up.
- Tip: Internal audit or an external consultant both count.
Policies & documents to have
- Internal audit procedure
- Management review procedure
- Risk Management Policy
FAQ
Is A.5.35 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.35?
Be ready to explain how the control works in your organisation and to provide things like: Your plan for an independent review of your security programme, by someone outside the work being checked…