Compliance with policies, rules and standards for information security

What the control asks

How well the organization keeps to its security policy and to its topic policies, rules and standards is to be checked regularly. Purpose: confirm that security is put in place and operated the way the top policy and the topic policies, rules and standards demand. Guidance: managers and owners of services, products or information work out how to check that what the policies, rules, standards and any applicable regulations require is actually happening, and should consider automated measurement and reporting tools to make regular review efficient. When non-compliance is found they identify its causes, assess whether corrective action is needed, implement suitable action, and review that action to confirm it worked and to spot any remaining weaknesses. The results of reviews and corrective actions are recorded and the records kept, and managers pass them to independent reviewers (5.35) when an independent review covers their area. Corrective actions are completed promptly in proportion to risk, and any not finished by the next scheduled review are at least followed up there. Monitoring how systems are used day to day falls under 8.15 to 8.17.

Purpose in the standard’s terms, in our words: Confirms security is put in place and run as the organization's policies, rules and standards require.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Identify, Protect; Legal and compliance, Information security assurance; Governance and ecosystem.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• A compliance review plan identifying which managers or owners review which policies, rules and standards and how often
• Compliance review results, including output from automated measurement or configuration compliance tools
• Non-compliance records with root causes, corrective actions, owners and target dates
• Evidence that corrective actions were reviewed for effectiveness
• Records showing results were supplied to independent reviewers when an independent review covered the area
• Tracking of overdue corrective actions at the next scheduled review

Where audits commonly find gaps

• Compliance checks are left entirely to the security team rather than line managers and owners
• Non-compliances are fixed without identifying causes, so they recur
• Corrective actions slip indefinitely with no follow-up
• Technical standards such as hardening baselines are never measured against actual configurations

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (18.2.2, 18.2.3) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.35 Independent review of information security
• 5.22 Monitoring, review and change management of supplier services
• 5.31 Legal, statutory, regulatory and contractual requirements

Read the five attributes All 93 controls