Independent Security Review Checklist Template (ISO/IEC 27001 A.5.35, A.5.36)

Independent Security Review and Compliance Review Checklist: [Organization name]

Planning form, checklist and report format for two related controls of ISO/IEC 27001:2022 + Amd 1:2024 Annex A: A.5.35 (independent review of security: an objective look at the whole ISMS approach, planned and also triggered by major change) and A.5.36 (compliance with security policies and standards: managers and technical checks confirm that the rules are followed). Read the official control text for the exact requirements. It explains how both differ from the internal audit required by clause 9.2 and from management review in clause 9.3. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and scope
2. Independent review, compliance review and internal audit compared
3. Review programme and triggers
4. Reviewer independence and competence
5. Checklist A: independent review of the ISMS approach (A.5.35)
6. Checklist B: management compliance reviews (A.5.36)
7. Checklist C: technical compliance reviews (A.5.36)
8. Ratings and findings
9. Reporting and follow-up
10. Size tiers
11. Records and evidence
12. References

1. Purpose and scope

This document records how [Organization name] obtains an objective view of whether the way it runs information security still fits its risks, has enough people and money behind it, and actually works in practice. It has three parts that answer different questions:

• Independent review (A.5.35): is our overall approach to information security (policies, organization, processes, resources, controls) right for our risks and objectives, and is it implemented as designed? Done by people independent of the area reviewed.
• Management compliance review (A.5.36): in each area, do people and processes stick to the security documents written for them, from the top-level policy down to local rules? Done by the managers who own the area, or someone they appoint.
• Technical compliance review (A.5.36): do systems actually match the required configurations and rules? Done with tools and by technical reviewers, without disturbing operations.

Scope of this cycle: [ISMS scope as in DOC-ISMS-002, with any areas added because of significant change].

2. Independent review, compliance review and internal audit compared

Decision for this organization: [Example: the annual internal audit covers conformity; a separate external independent review every second year covers the approach as a whole; in the other year the internal audit terms of reference include section 5 of this checklist and the report says so.]

3. Review programme and triggers

3.1 Programme

3.2 Triggers for an extra independent review

Run an independent review outside the plan when any of these occurs:

• a merger, acquisition, divestment or new legal entity in scope;
• a major outsourcing or insourcing decision, or a change of primary cloud provider;
• a major incident, or a pattern of incidents with a shared cause;
• a significant change of risk appetite, business model or regulation (for example becoming subject to NIS2 or DORA);
• replacement of the CISO or ISMS manager, or a major reorganization of security roles;
• a certification body finding that questions the ISMS approach.

The ISMS manager records each trigger, the decision to review or not, and who approved the decision.

4. Reviewer independence and competence

4.1 Independence criteria

Any "No" needs a written mitigation (for example a second reviewer, a reduced scope or a different reporting line) approved by top management.

4.2 Competence

Record competence in the competence and training matrix (DOC-ISMS-026).

4.3 Declaration of independence

Each reviewer signs this declaration before fieldwork starts. Keep the signed copy with the review file.

I, [name], appointed as reviewer for [review ID], confirm that:
- I have not designed, operated or managed the activities in scope in the
  last [12] months;
- I do not report to the owner of the activities in scope;
- I have no financial or personal interest in the outcome;
- I will report to [top management role] without prior approval of the
  content by the owners of the areas reviewed.
Conflicts declared: [none / description and mitigation]
Signed: [name]   Date: YYYY-MM-DD

5. Checklist A: independent review of the ISMS approach (A.5.35)

6. Checklist B: management compliance reviews (A.5.36)

Area: [area] Manager: [@manager] Period: [YYYY-MM-DD to YYYY-MM-DD]

Worked example (Example), Engineering area at Quillmere Analytics Ltd: CR-02 sampled 10 access changes; 9 matched an approved ticket and 1 leaver kept repository access for 6 days. Result: Partly compliant (9 of 10, 90%). Cause: leaver ticket raised by the manager after the last day. Action: automate repository de-provisioning from the HR system, owner [@platform-lead], recorded as finding AF-2027-014 in the audit findings register.

7. Checklist C: technical compliance reviews (A.5.36)

Before any intrusive test, agree the scope, timing, accounts and rollback with the system owner, and record the approval. Penetration tests and vulnerability assessments are done by competent, authorized people only.

8. Ratings and findings

Findings that are nonconformities with ISMS requirements are handled through corrective action (cl. 10.2, DOC-ISMS-087). Improvement opportunities go to the continual improvement register (DOC-ISMS-088).

9. Reporting and follow-up

Report contents for an independent review:

1. Terms of reference, scope, period and reviewer independence statement.
2. Method: documents examined, interviews, samples, technical tests.
3. Overall conclusion on suitability, adequacy and effectiveness.
4. Results per Checklist A item with ratings.
5. Findings and recommendations, ranked by risk.
6. Management responses, including recommendations not accepted and why.
7. Comparison with the previous review.

Compliance review results are summarized quarterly in the ISMS performance report (DOC-ISMS-081) as compliance rates per area and per technical check, with trends. Overdue actions are escalated to the ISMS steering committee (DOC-ISMS-007).

Worked example (Example): in the first quarter Quillmere Health Systems ran 6 management compliance reviews with 10 items each (60 items). 51 were compliant, 7 partly compliant and 2 not compliant (51 + 7 + 2 = 60). Compliance rate: 51 of 60, or 85%. The 9 findings were entered in the audit findings register with owners and dates.

10. Size tiers

11. Records and evidence

Set the final retention periods in the documented information register (DOC-ISMS-028).

12. References

Official pages: ISO/IEC 27001 https://www.iso.org/standard/82875.html, Amd 1 https://www.iso.org/standard/88435.html, ISO/IEC 27002 https://www.iso.org/standard/75652.html, ISO/IEC 27007 https://www.iso.org/standard/77802.html, ISO/IEC TS 27008 https://www.iso.org/standard/67397.html, ISO 19011 https://www.iso.org/standard/88984.html.

Related templates: compliance/internal-audit-program, isms/isms-internal-audit-checklist, isms/isms-internal-audit-report, compliance/management-review, isms/audit-findings-register, compliance/capa-nonconformity, isms/continual-improvement-register, ops/access-review, security/firewall-rule-review, security/cloud-security-posture-review, security/pentest-report, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A controls A.5.35 and A.5.36 and clauses 9.2 and 9.3. The questions, checklists, rating scale, comparison table and examples are original wording. ISO/IEC text is not reproduced: clause and control numbers are given with short descriptions written for this template, not the official titles, requirements or guidance text. ISO and IEC standards are copyrighted; obtain the official standards from ISO or your national standards body before relying on this template. Check the current edition and amendments of each standard before use. This is a documentation format, not certification advice. Template licence: MIT.