5.35 Independent Review of Information Security

The organisation's approach to managing information security and its implementation including people, processes and technologies should be reviewed independently at planned intervals, or when significant changes occur.

An information security management system is effective if it is regularly reviewed, updated, and communicated.

It is beneficial for an organisation to establish a procedure to review any amendments occurring within the organisation to reflect the ISMS. The organisation should carry out this on regular bases. Reviews are generally commenced on annual bases. Points to review include, but are not limited to:

• Laws and regulations which affect the organisation change
• Significant incidents occur
• The organisation implements a major change to the current business or adds a new business in the scope
• Organisation using or producing new products or services.
• Major changes to the organisation's policies and procedures.
It is also required the organisation requires to establish an audit program which would keep the internal and external audits into consideration.