ISO 27001 A.5.35: Independent review of information security

Set up an internal audit programme with regular independent reviews of the ISMS. Plan to cover all aspects of the ISMS over a defined cycle (typically 1-3 years), reviewing higher-risk areas more frequently. Define your methodology: interviews, document review, technical testing, and observation. Make sure auditors are independent. They must not review areas they are directly responsible for. Cross-functional audit teams work well - your IT auditor reviews physical security, your physical security lead reviews IT controls. External auditors add objectivity. Auditors need to be competent in both information security and audit techniques. ISO 19011 is a good reference for methodology. Scope reviews to cover ISMS governance, risk assessment and treatment, control implementation, security awareness effectiveness, incident management, supplier security, policy compliance, and regulatory alignment. Follow a structured approach. Prepare an audit plan, gather evidence through document review, interviews, observation, and technical testing. Assess findings against ISO 27001 requirements, your own policies, and the statement of applicability. Classify findings by severity: major nonconformity, minor nonconformity, observation, or opportunity for improvement. Report findings to management and track corrective actions through to completion. Define response timeframes based on severity. Verify that corrective actions actually fix the problem. Use findings to drive continuous improvement. Keep records of all audits, findings, and corrective actions - the certification body will want to see them.