## 5.35 Independent review of information security

  

| Control type            | Information security properties           | Cybersecurity concepts | Operational capabilities        | Security domains          |
| ----------------------- | ----------------------------------------- | ---------------------- | ------------------------------- | ------------------------- |
| #Preventive #Corrective | #Confidentiality #Integrity #Availability | #Identify #Protect     | #Information_security_assurance | #Governance_and_Ecosystem |

**Control**
The organization’s approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur.

**Purpose**
To ensure the continuing suitability, adequacy and effectiveness of the organization’s approach to managing information security.

**Guidance**
The organization should have processes to conduct independent reviews.

Management should plan and initiate periodic independent reviews. The reviews should include assessing opportunities for improvement and the need for changes to the approach to information security, including the information security policy, topic-specific policies and other controls.

Such reviews should be carried out by individuals independent of the area under review (e.g. the internal audit function, an independent manager or an external party organization specializing in such reviews). Individuals carrying out these reviews should have the appropriate competence. The person conducting the reviews should not be in the line of authority to ensure they have the independence to make an assessment.

The results of the independent reviews should be reported to the management who initiated the reviews and, if appropriate, to top management. These records should be maintained.

If the independent reviews identify that the organization’s approach and implementation to managing information security is inadequate \[e.g. documented objectives and requirements are not met or are not compliant with the direction for information security stated in the information security policy and topic-specific policies (see [5.1](a-5.1-Policies-for-information-security.md))\], management should initiate corrective actions.

In addition to the periodic independent reviews, the organization should consider conducting independent reviews when:

a\) laws and regulations which affect the organization change;

b\) significant incidents occur;

c\) the organization starts a new business or changes a current business;

d\) the organization starts to use a new product or service, or changes the use of a current product or service;

e\) the organization changes the information security controls and procedures significantly.

ISO/IEC 27007 and ISO/IEC TS 27008 provide guidance for carrying out independent reviews.