ISO 27001:2022
Organizational controls – ISO 27001:2022

ISO 27001:2022 5.35: Independent review of information security

How the organization manages information security, and how that is carried out through people, processes and technology, is to be examined by someone independent on a planned cycle and whenever a significant change occurs. Purpose (stated in ISO/IEC 27002:2022): keeps the way information security is managed suitable, adequate and effective. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.35.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 154 controls across 38 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 16 controls

  • 10.4.2.1 10.4.2.1 Periodic log review frequency set by targeted risk analysis
  • 10.4.3 10.4.3 Exceptions and anomalies from log review addressed
  • 11.4.1 11.4.1 Penetration testing methodology defined and implemented
  • 11.4.2 11.4.2 Internal penetration testing annually and after change
  • 11.4.3 11.4.3 External penetration testing annually and after change
  • 11.4.5 11.4.5 Annual segmentation penetration testing
  • 11.4.6 11.4.6 Service provider segmentation testing every six months
  • 12.3.2 12.3.2 Targeted risk analysis for each customized-approach requirement
  • 12.3.3 12.3.3 Cryptographic cipher suite and protocol inventory reviewed annually
  • 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
  • 12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
  • 12.5.2 12.5.2 Annual and change-driven scope confirmation
  • 4.1.1 4.1.1 Requirement 4 policies and procedures maintained and communicated
  • 6.2.3.1 6.2.3.1 Manual code review independence and approval
  • 9.4.1.1 9.4.1.1 Secure storage location for offline backups
  • 9.4.1.2 9.4.1.2 Annual review of offline backup location security

FedRAMP High · 14 controls

  • AC-6(7) Review of User Privileges
  • CA-2 Control Assessments
  • CA-2(1) Independent Assessors
  • CA-2(3) Control Assessments | Leveraging Results from External Organizations (CA-2(3))
  • CA-7 Continuous Monitoring
  • CA-7(1) Independent Assessment
  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))
  • CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2))
  • PL-2 System Security and Privacy Plans
  • PL-8 Security and Privacy Architectures
  • RA-3 Risk Assessment
  • SI-6 Security and Privacy Function Verification (SI-6)
  • SR-1 Policy and Procedures (SR-1)

FedRAMP Moderate · 14 controls

  • AC-6(7) Review of User Privileges
  • CA-2 Control Assessments
  • CA-2(1) Independent Assessors
  • CA-2(3) Control Assessments | Leveraging Results from External Organizations (CA-2(3))
  • CA-7 Continuous Monitoring
  • CA-7(1) Independent Assessment
  • CA-8 Penetration Testing
  • CA-8(1) Penetration Testing | Independent Penetration Testing Agent or Team (CA-8(1))
  • CA-8(2) Penetration Testing | Red Team Exercises (CA-8(2))
  • PL-2 System Security and Privacy Plans
  • PL-8 Security and Privacy Architectures
  • RA-3 Risk Assessment
  • SI-6 Security and Privacy Function Verification (SI-6)
  • SR-1 Policy and Procedures (SR-1)

NIST SP 800-53 Rev 5 · 14 controls

NIST Cybersecurity Framework 2.0 · 11 controls

  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
  • NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission
  • NIST-CSF-GV.RM-01 Risk management objectives are established and agreed to by organizational stakeholders
  • NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.IM-01 Improvements are identified from evaluations
  • NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
  • NIST-CSF-ID.RA-08 Processes for receiving, analyzing, and responding to vulnerability disclosures are established
  • NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use

ISO/IEC 42001:2023 · 9 controls

  • 10.1 Continual improvement
  • 10.2 Nonconformity and corrective action
  • 6.1.2 AI risk assessment
  • 9.2 Internal audit
  • 9.2.1 General
  • 9.2.2 Internal audit programme
  • 9.3 Management review
  • A.2.4 Review of the AI policy
  • A.3 Internal organization

ISO 22301:2019 · 8 controls

  • 10.1 Nonconformity and corrective action
  • 10.2 Continual improvement
  • 8.6 Evaluation of business continuity documentation and capabilities
  • 9.2 Internal audit
  • 9.2.1 General
  • 9.2.2 Audit programme(s)
  • 9.3 Management review
  • 9.3.1 General

ISO 27701:2019 · 8 controls

  • 5.7 Performance evaluation
  • 5.7.2 Internal audit
  • 5.8 Improvement
  • 5.8.1 Nonconformity and corrective action
  • 5.8.2 Continual improvement
  • 6.15.2 Information security reviews
  • 6.3.1 Internal organization
  • 6.9.7 Information systems audit considerations

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 5 controls

APRA CPS 230 Operational Risk Management · 4 controls

  • CPS230-16 Internal Audit Review of the Business Continuity Plan
  • CPS230-49 Internal Audit Review of Proposed Critical Operation Outsourcing
  • CPS230-66 Review of Operational Risk Management
  • CPS230-P30 Monitoring, Review and Testing of Control Effectiveness

APRA CPS 234 · 4 controls

  • CPS234-22 Systematic Control Testing Program
  • CPS234-25 Internal Audit Review of Information Security Controls
  • CPS234-P30 Independence and Skill of Testing Personnel
  • CPS234-P31 Annual Review of Testing Program Sufficiency

CIS Controls v8 · 4 controls

  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-18.2 Perform Periodic External Penetration Tests
  • CIS-18.5 Perform Periodic Internal Penetration Tests
  • CIS-7.2 Establish and Maintain a Remediation Process

SOC 2 · 4 controls

  • SOC2-CC1.1 CC1.1 Commitment to integrity and ethical values (COSO principle 1)
  • SOC2-CC1.2 CC1.2 Board independence and oversight of internal control (COSO principle 2)
  • SOC2-CC4.1 CC4.1 Ongoing and separate evaluations of control (COSO principle 16)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

COBIT 2019 · 3 controls

  • APO13.03 APO13.03 Monitor and review the information security management system (ISMS)
  • MEA03.04 MEA03.04 Obtain assurance of external compliance
  • MEA04.01 MEA04.01 Ensure that assurance providers are independent and qualified

NIS2 Directive · 3 controls

  • Art.21.2.f Policies and procedures to assess the effectiveness of the cybersecurity risk-management measures
  • Art.21.4 Take corrective measures without undue delay on finding that the measures are not met
  • Art.32 Cooperate with supervision: inspections, security audits, scans and requests for information and evidence

NIST SP 800-53A Rev. 5 · 3 controls

  • 53A-3.1 Prepare for Control Assessments
  • 53A-3.3 Conduct Control Assessments
  • 53A-E Assessment Reports

C5 (Germany) · 2 controls

  • C5-COM-02 Policy for planning and conducting audits
  • C5-COM-03 Internal audits of the information security management system

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

CMMC 2.0 · 2 controls

GDPR · 2 controls

HIPAA Security Rule · 2 controls

ISO 27002:2022 · 2 controls

  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security

NIST SP 800-172 · 2 controls

  • 3.11.5e Assess Effectiveness of Security Solutions
  • 3.12.1e Penetration Testing by Independent Agents

NIST SP 800-66 Rev 2 · 2 controls

AML/CTF Act 2006 (Australia) · 1 control

  • AMLCTF-PartA-Review Independent Review

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

AWS Well-Architected Security Pillar · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

Australia My Health Records Act 2012 · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

  • AEO-13 Measurement, Analyses and Improvement

Azure Security Benchmark · 1 control

DORA · 1 control

EU AI Act · 1 control

Equator Principles (EP4, 2020) · 1 control

ISO 27001:2013 · 1 control

  • A.18.2.1 Independent review of information security

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Organizational controls – ISO 27001:2022

You are reading one control. How much of ISO 27001:2022 have you already done?

ISO 27001:2022 5.35 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold ISO 27001:201383.9% covered · 15 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 154 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27001:2022 controls