## 5.36 Compliance with policies, rules and standards for information security

| Control type | Information security properties           | Cybersecurity concepts | Operational capabilities                              | Security domains          |
| ------------ | ----------------------------------------- | ---------------------- | ----------------------------------------------------- | ------------------------- |
| #Preventive  | #Confidentiality #Integrity #Availability | #Identify #Protect     | #Legal_and_compliance #Information_security_assurance | #Governance_and_Ecosystem |

**Control**
Compliance with the organization’s information security policy, topic-specific policies, rules and standards should be regularly reviewed.

**Purpose**
To ensure that information security is implemented and operated in accordance with the organization’s information security policy, topic-specific policies, rules and standards.  

**Guidance**
Managers, service, product or information owners should identify how to review that information security requirements defined in the information security policy, topic-specific policies, rules, standards and other applicable regulations are met. Automatic measurement and reporting tools should be considered for efficient regular review.

If any non-compliance is found as a result of the review, managers should:

a\) identify the causes of the non-compliance;

b\) evaluate the need for corrective actions to achieve compliance;

c\) implement appropriate corrective actions;

d\) review corrective actions taken to verify its effectiveness and identify any deficiencies or weaknesses.

Results of reviews and corrective actions carried out by managers, service, product or information owners should be recorded and these records should be maintained. Managers should report the results to the persons carrying out independent reviews (see [5.35](a-5.35-Independent-review-of-information-security.md)) when an independent review takes place in the area of their responsibility.

Corrective actions should be completed in a timely manner as appropriate to the risk. If not completed by the next scheduled review, progress should at least be addressed at that review.

**Other information**
Operational monitoring of system use is covered in 8.15, 8.16, 8.17.