ISO 27001 A.5.35: Make Independent Security Reviews Useful

What A.5.35 requires in practice

Control A.5.35 requires an independent review of how the organisation manages information security, including how it is carried out across people, processes and technologies, held at planned intervals and whenever significant changes occur. Independent here means the reviewer is not the person responsible for what is being reviewed.

In practice the control calls for a plan for independent review, reviewers who are objective and competent, and a route for results to reach management and drive action. It also expects reviews after major change. The control does not require an external firm; a capable internal reviewer from outside the area under review can be suitable. It also differs from the management system internal audit in purpose and perspective, although the two can inform one another.

Define what the review must establish

Begin with a useful question. Has a new service model changed the security responsibilities? Are controls operating as designed across a newly acquired business? Does the risk assessment still reflect the information that matters? Scope the review around decisions that management can act upon.

Include implementation as well as documentation. A policy may be well written while systems and staff follow a different process. Select evidence from representative activities and examine the interfaces where responsibility passes between teams. A review limited to file existence may miss the most consequential weaknesses.

Set clear boundaries and reporting expectations. Reviewers should know the criteria, systems and locations in scope, any constraints on access and how sensitive findings will be protected. Disclose limitations so that management does not mistake a narrow sample for assurance over the entire organisation.

Choose independence and competence together

Independence concerns the reviewer’s relationship to the area and decisions under review. An employee from another appropriate function may be sufficiently independent; an external person is not automatically independent of work they designed or operate. Consider conflicts and reporting lines rather than relying on a job title.

Competence must fit the subject. Reviewing a complex cloud responsibility model may require different expertise from reviewing staff onboarding. A team can combine skills where necessary. The organisation needs a credible conclusion, not simply a reviewer who has never worked in the department.

Why independent security reviews matter to the business

People who run a system tend to see it through familiar eyes and miss what an outsider spots at once. An independent review brings a fresh and unbiased view of whether security arrangements actually work, not just whether they exist on paper. Management gains reliable information for decisions, and clients gain assurance that the organisation looks critically at itself. A review that produces action, rather than a report left on a shelf, improves the system in ways day-to-day operation seldom does. Auditors value evidence that findings were considered by management and led to changes.

How to implement A.5.35

Make the review useful by choosing scope and reviewers with care and following through on results. A practical sequence follows. A review is valuable only if its findings are heard. Agree with management beforehand what the review is for and who will receive the result. Pick reviewers who can speak frankly and who understand the subject, and let them see how work is really done, not just the documents. Resist the temptation to defend every finding; the point is to learn where the system is weaker than it appears.

1. Decide the scope, such as a service, a site or a theme, and the reasons for it.
2. Choose reviewers who are independent of the area and competent in it.
3. Plan reviews at intervals and set triggers for extra reviews after significant change.
4. Give reviewers access to people, records and systems they need.
5. Report findings to management in language that supports decisions.
6. Agree actions with owners and record them.
7. Follow up and use results to shape the next review.

Illustrative software example: the designer reviews the design

Illustrative manufacturing example: a service model has changed

A hypothetical manufacturer moves from local system administration to an external managed service. Existing review activities still concentrate on local administrator tasks, leaving unclear which party monitors access and handles security incidents.

An independent review examines the changed responsibility boundary, samples actual handovers and compares practice with agreements. Management receives findings about gaps and duplication. The review is triggered by a significant change, rather than waiting for the old annual checklist to reach its next date.

Report conclusions that support decisions

Explain the evidence, consequence and scope of each finding. Distinguish a failure to meet a requirement from an improvement suggestion. Avoid presenting personal preferences as mandatory ISO rules, and avoid reducing a consequential weakness to a vague recommendation to “be more careful.”

Report to the management that commissioned the review and escalate appropriately. Assign actions and verify their effect. A review has little value when the report is filed without a decision about significant weaknesses. Connect findings with corrective action where applicable.

Keep independent and routine review connected

Routine owners’ checks under compliance with security rules provide useful inputs. Independent review can examine whether those checks are reliable and whether the rules themselves remain suitable. Neither activity should exist merely to duplicate the other’s paperwork.

Relevant incidents, major business changes or revised controls can justify review outside the planned cycle. The organisation should have a way to recognise those triggers and decide the appropriate scope, rather than treating the calendar as the only reason to review.

Evidence and common weaknesses