Compliance with Policies, Rules and Standards - ISO 27001 Annex A Control
ISO 27001 Annex A 5.36
Having policies in place is not the same as following them.
ISO 27001 Annex A 5.36 - Compliance with Policies, Rules and Standards
Having policies in place is not enough. The control asks whether the policies are actually being followed. This is the operational test that complements Annex A 5.1 - the policy framework exists, and now the organisation has to confirm it is being applied in practice.
Compliance review can take several forms. Sample testing - picking a control and checking the actual evidence behind it. System-based monitoring - automated checks that flag deviations from policy such as unpatched systems or expired access. Self-assessment by control owners against a defined checklist. Each method has strengths, and most organisations use a combination.
Where non-compliance is found, the response should be proportionate to the cause. Genuine errors get corrected and the cause addressed. Pattern non-compliance suggests a problem with the policy, the training or the control design and needs deeper investigation. Deliberate non-compliance triggers the disciplinary process. The audit will look at how the organisation distinguishes these and acts accordingly.
For us the compliance review is built into the regular management cycle. Each topic policy has an owner who reports quarterly on compliance, with sample evidence. Issues get logged and tracked. Patterns get escalated. The audit trail at the end of the year shows what we tested, what we found and what we did about it.
The aim is not zero non-compliance because that is unrealistic. The aim is that issues are found, recorded and addressed.
Practical Compliance Guidance
Compliance monitoring is described in the IMS1 Manual in section 8 on information security arrangements. The audit checklist supports the structured review of policy compliance and the worker read-and-understood form provides evidence of awareness.
| alphaZ document | How to use it |
|---|---|
| ISO 27001 Toolkit | The full alphaZ ISO 27001 toolkit covering manual, policies, procedures, registers and audit checklists. |
| F-Q24 Worker Read and Understood | Records that workers have read and understood the relevant policies. Use as the baseline evidence that staff have been made aware of the rules they are expected to follow. |
| INF1-1 Information Security Awareness Staff Handbook | Information Security Awareness Staff Handbook is a 10-page illustrated handbook for issue to staff to assist with training and raising awareness of information security considerations and best practice. |
| PP-8-100 Information Security Policy Procedure | This information security policy-procedure includes all topic-specific information security policies requried by the ISO 27001 standard. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
How is this different from the independent review under A.5.35?
A.5.35 is about independent review of the management system as a whole, typically through internal or external audit. A.5.36 is about ongoing compliance monitoring of specific policies and rules - typically done by control owners or compliance functions rather than independent auditors. The two are complementary.
How do we evidence compliance monitoring?
Through documented review records showing what was checked, what evidence was used, what was found and what action was taken. Compliance dashboards, self-assessment returns and corrective action logs all contribute. The audit will sample these to confirm the monitoring activity is real and that findings are followed through.
What about technical compliance such as system configuration?
Technical compliance often benefits from automated monitoring such as configuration management tools, vulnerability scans and security event monitoring. The output of these tools should feed into the compliance picture alongside the manual reviews. Annex A 8.8 on management of technical vulnerabilities and A.8.16 on monitoring activities cover the technical side specifically.