Regularly review compliance with the organisation's IS policy, topic-specific policies, rules and standards.
Also written as A5.36, Annex A 5.36, ISO 27001:2022 A.5.36, ISO27001 A.5.36.
Compliance with policies, rules and standards for information security is one of 37 Organisational Controls in ISO/IEC 27001:2022 Annex A. Regularly review compliance with the organisation's IS policy, topic-specific policies, rules and standards. Organisational controls are judged on governance rather than tooling: an auditor wants a named owner, an approval trail, and evidence the control is exercised on a defined cadence rather than written once and filed.
When preparing your Statement of Applicability (SoA) for A.5.36, gather artefacts such as:
If you run more than one framework, the same evidence usually satisfies all of them. A.5.36 aligns with:
SOC 2: CC1.5 Accountability for internal control, CC4.1 Ongoing and separate evaluations
NIST CSF 2.0: GV.PO-02 Policy reviewed and updated, GV.OV-02 Strategy reviewed and adjusted for coverage, ID.IM-01 Improvements from evaluations
A.5.36 consolidates the following ISO 27001:2013 control(s): A.18.2.2, A.18.2.3. If you are transitioning an existing ISMS, map your prior evidence for these to A.5.36 in your updated SoA.
Annex A controls are not mandatory in the abstract. Clause 6.1.3 requires you to compare your risk treatment plan against Annex A and justify, in the Statement of Applicability, any control you exclude. If your risk assessment surfaces a risk that A.5.36 addresses, excluding it needs a documented, risk-based rationale that an auditor will test.
In two passes. First design: does a documented control exist, is it owned, and does it address the risk? Then operating effectiveness: the auditor samples records from across the audit period to confirm the control actually ran. A Stage 2 audit will typically pull several samples, so evidence that only exists for the month before the audit is a common finding.
ISO 27001 sets no fixed interval — it requires review at "planned intervals" and after significant change. Annual review is the norm most certification bodies expect, with an out-of-cycle review triggered by incidents, major system changes, restructures, or new regulatory obligations. Record the review date and outcome either way; an undated control is treated as unreviewed.
A.5.36 aligns with SOC 2 CC1.5, CC4.1 and NIST CSF GV.PO-02, GV.OV-02, ID.IM-01. Evidence gathered for one framework will usually satisfy the others, which is the basis for a test-once, satisfy-many control library.
A.5.36 consolidates 2 control(s) from the 2013 edition: A.18.2.2, A.18.2.3. When transitioning, re-point the existing evidence rather than rebuilding it — the underlying requirement has not changed materially.