All 93 controls · Organizational controls
Control 5.35
Independent review of information security
What ISO/IEC 27002:2022 control 5.35 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
How the organization manages information security, and how that is carried out through people, processes and technology, is to be examined by someone independent on a planned cycle and whenever a significant change occurs. Purpose: keep the way information security is managed suitable, adequate and effective over time. Guidance: have processes for independent review, which management plans and initiates periodically. Reviews assess improvement opportunities and whether the approach needs changing, covering the top-level policy, the topic policies and the other controls. Reviewers are independent of the area reviewed (for example internal audit, a manager from elsewhere or a specialist external firm), competent, and outside the line of authority for that area. Results go to the management that commissioned the review and, where appropriate, to top management, and records are kept. Where a review finds the approach or implementation inadequate, for example objectives and requirements not met or practice not in line with the policies (5.1), management starts corrective action. Beyond the periodic cycle, consider an independent review when relevant laws and regulations change, after significant incidents, when a new business is started or an existing one changes, when a product or service is newly adopted or used differently, and when security controls and procedures change substantially. Guidance on conducting such reviews is in ISO/IEC 27007 and in ISO/IEC TS 27008.
Purpose in the standard’s terms, in our words: Keeps the way information security is managed suitable, adequate and effective.
Attribute values in one line: Preventive, Corrective; Confidentiality, Integrity, Availability; Identify, Protect; Information security assurance; Governance and ecosystem.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | PreventiveCorrective |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | IdentifyProtect |
| Operational capabilities | Information security assurance |
| Security domains | Governance and ecosystem |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- A management-approved programme of periodic independent reviews of information security
- Review reports by reviewers independent of the area, with evidence of their competence and independence
- Reports of results to the commissioning management and to top management where appropriate
- Corrective action plans raised from review findings and evidence of their completion
- Records of event-driven reviews triggered by legal change, significant incidents, new business or services, or major control changes
Where audits commonly find gaps
- Reviews are carried out by staff who report into the area being reviewed
- Reviews happen only on a fixed schedule and are not triggered by significant change
- Findings are reported but no corrective action is initiated
- Reviewers lack information security competence, so reviews are superficial
What ISO/IEC 27028 changes for this control
It carries more than one control type (preventive, corrective), so the register should record each and the evidence that proves each one operates. It contributes no detect function, so a control set built from this row alone would not show detection. Its earlier numbering (18.2.1) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.