Key takeaways
- Check regularly that people and systems follow your security rules.
- Policies are only useful if people follow them.
- Start here: ask managers and control owners to check compliance in their areas.
Purpose
Check regularly that people and systems follow your security rules.
Requirement
Requirement summaryCompliance with the organization’s information security policy, topic-specific policies, rules and standards shall be regularly reviewed.
Why it matters
Policies are only useful if people follow them. Compliance checks show whether reality matches the paperwork.
How to implement
- Ask managers and control owners to check compliance in their areas.
- Use technical checks such as configuration scans where possible.
- Record non-compliance and corrective actions.
- Report trends to management.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.36. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your approach to checking that people follow security policies.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.36 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Records of compliance checks, such as spot checks or technical scans.
- Records of problems found and how they were fixed.
Things you should be able to show or explain
- Managers should be able to explain how they check their area.
How much to show: Three to five checks.
Common mistakes
- No checks done.
- Problems found but not fixed.
- Only checking compliance just before the external audit.
- Non-compliance noted but not fixed.
- Tip: Use automated compliance checks where possible.
Policies & documents to have
- Internal audit procedure
- Management review procedure
- Risk Management Policy
FAQ
Is A.5.36 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.36?
Be ready to explain how the control works in your organisation and to provide things like: Your approach to checking that people follow security policies…