Security controls only work if people actually follow them.
Annex A 5.36 exists to ensure organisations monitor, review, and enforce compliance with their own information security policies, rules, and standards, and take corrective action when deviations are identified.
This control is about closing the gap between documented intent and operational reality.
Annex A 5.36 of ISO 27001:2022 focuses on compliance with internal information security policies, rules, and standards.
At a practical level, this means:
The control does not require constant monitoring or technical audits of every system. It expects a structured, risk-based approach to confirming that agreed security rules are being applied as intended.
Most organisations have documented security policies and standards.
However, common failures include:
Annex A 5.36 ensures organisations actively check whether their own rules are being complied with, rather than assuming that documentation alone delivers security.
This control replaces and consolidates compliance-focused controls from ISO 27001:2013, reinforcing that ongoing compliance is both a preventive and corrective activity.
A pragmatic approach to Annex A 5.36 typically includes the following elements.
People cannot comply with rules they cannot find or understand.
Organisations should ensure that:
Accessibility supports accountability.
Compliance monitoring should have clear ownership.
This often sits with:
Ownership ensures compliance is actively managed, not passively assumed.
Compliance should be reviewed at planned intervals.
Reviews may include:
The depth of review should reflect risk, not uniformity.
Where non-compliance is identified, organisations should:
Non-compliance is a signal, not all signals carry the same weight.
Where corrective action is appropriate, organisations typically:
Corrective action should address causes, not just symptoms.
After action is taken, organisations should consider:
Unverified corrective action often becomes assumed success.
Annex A 5.36 does not require organisations to:
It does expect organisations to:
This control supports continuous improvement, not punitive enforcement.
Compliance degrades when it is not observed.
Annex A 5.36 is about keeping security controls alive.
When compliance with policies, rules, and standards is monitored and managed:
Policies define intent.
Annex A 5.36 ensures that intent is realised in practice.
We can help you understand your actual security needs and even if we cant help we can point you in the right direction
Talk to a security expert today
