ISO 27001 A.5.36: Check Compliance with Security Rules

What A.5.36 requires in practice

Control A.5.36 requires regular checks that the organisation is following its own information security policy, its topic-specific policies, rules and standards. This is different from independent review: here, managers and responsible owners check that their own areas follow what has been set.

In practice the control expects managers to look at whether people and systems follow the rules, to record where they do not, and to take corrective action. Technical checks, such as configuration comparisons, can be part of this. When non-compliance is found, the cause should be understood and fixed, not just noted. The standard does not prescribe the form of check; a simple periodic review by each area owner with results reported upwards is one practical method that suits many organisations.

Why checking compliance with security rules matters to the business

Rules that nobody checks drift into irrelevance. Over time, workarounds become normal, exceptions multiply and the policy describes an organisation that no longer exists. Regular checks catch that drift while it is cheap to correct and keep management informed about how things actually work. They also generate the evidence clients and auditors want to see: that policies are living instruments. Where checks find that a rule cannot realistically be followed, that is valuable feedback to improve the rule. The approach strengthens accountability by making each area responsible for its own position.

How to implement A.5.36

Place the responsibility with the people who run each area and keep the checks light enough to sustain. One route is described below. Compliance checks are easy to turn into a paper exercise, so keep them close to real work. Ask managers to look at how tasks are actually done and to sample records, not just confirm that a policy exists. Treat repeated non-compliance as a signal that the rule or the training may be at fault. Share the pattern of findings with management, so effort goes to the areas that most need it.

1. List the policies, rules and standards that need to be checked.
2. Assign each area owner responsibility for checking compliance in their area.
3. Choose simple checks, combining conversation, record sampling and technical comparison.
4. Set a regular rhythm and record each review.
5. Investigate the cause of any non-compliance, not just the symptom.
6. Agree corrective actions and follow them up.
7. Report results to management and use them to refine rules.

Turn rules into questions that evidence can answer

Sample the work that could reveal a weakness

Illustrative IT example: approval exists but permissions differ

Illustrative BPO example: an exception becomes normal practice

A hypothetical BPO team uses a temporary file-transfer exception during a client-system outage. Months later, the workaround remains in daily use although the original expiry has passed. Staff believe it is approved because the team used it successfully during the disruption.

The manager confirms the current requirement, evaluates the continuing need and resolves the arrangement through the authorised route. Staff receive clear instructions, and later samples check actual transfer practice. The review treats expired exceptions as decisions needing attention rather than automatically blaming individuals who inherited an unclear workflow.

Understand why a requirement was missed

When a deviation is found, assess cause and consequence. It may involve an isolated mistake, inadequate competence, a missing technical capability or a rule that no longer fits operations. Appropriate correction and corrective action depend on that understanding.

Track significant actions to completion and evaluate effectiveness. If a process is redesigned, test the revised activity. If understanding was the problem, check whether the relevant audience can now apply the rule. A document update or training attendance record alone may not demonstrate that the original weakness has been resolved.

Use findings to improve policy and oversight

Repeated exceptions can indicate that policy design needs reconsideration. A review should not quietly lower requirements to make results look better, but it should provide evidence for an authorised policy decision. The organisation may need a better tool or workflow to make the required behaviour feasible.

Provide relevant results to independent reviewers and management. Explain significant unresolved issues, recurring causes and limitations in coverage. A high completion percentage is less useful than knowing which consequential requirement still lacks reliable implementation.

Evidence and frequent mistakes

Useful evidence includes review criteria, samples or measurements, results, investigated causes and verified actions. A.5.36 does not prescribe one form, software product or review frequency. Choose an approach that remains regular and responsive to risk and change.

Frequent mistakes include equating acknowledgement with compliance, checking only records created for the review and closing findings when an owner promises to act. Another is leaving repeated low-level deviations unconnected, even when together they reveal a systemic weakness. Link people-related gaps with awareness and training when learning is part of the justified response.