ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.36: Compliance with policies, rules and standards for information security
ISO 27001:2022 5.36 covers Compliance with policies, rules and standards for information security. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.36, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Compliance checks are left entirely to the security team rather than line managers and....
How well the organization keeps to its security policy and to its topic policies, rules and standards is to be checked regularly. Purpose (stated in ISO/IEC 27002:2022): confirms security is put in place and run as the organization's policies, rules and standards require. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.36.
What evidence supports 5.36?
- Annex A organizational controlStatement of Applicability entry for control A.5.36, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlA compliance review plan identifying which managers or owners review which policies, rules and standards and how often
- Annex A organizational controlCompliance review results, including output from automated measurement or configuration compliance tools
- Annex A organizational controlNon-compliance records with root causes, corrective actions, owners and target dates
- Annex A organizational controlEvidence that corrective actions were reviewed for effectiveness
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.36, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Compliance checks are left entirely to the security team rather than line managers and owners
- Non-compliances are fixed without identifying causes, so they recur
- Corrective actions slip indefinitely with no follow-up
- Technical standards such as hardening baselines are never measured against actual configurations
How it maps to SOC 2
- CC4.1 high Compliance reviews against policies and standards are the ongoing evaluations.
- CC4.2 high Compliance reviews identify and escalate nonconformities in a timely manner.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.