Back to all 93 controls
Annex A 5.35
Organizational
A.5.35 Independent review of information security
The ISMS is independently reviewed.
What good looks like
Internal audit programme plus, where appropriate, external assurance.
Evidence an auditor will ask for
Audit schedule, audit reports, management responses.
Document template for this control
The IT Security Audit Policy template gives you auditor-ready wording that fulfils Annex A 5.35. Preview the full document before you download the editable version.