ISO 27001 A.5.36: Compliance with policies, rules and standards for information security

Build a compliance monitoring programme that systematically checks adherence to your security policies and standards across the organisation. Define what gets reviewed, how, by whom, and how often.

For personnel compliance, run regular checks: verify policy acknowledgments are signed, review security awareness assessment results, do clean desk checks, walk through physical security, observe security practices in action, review incident reports for policy violations, and sample user activity against acceptable use policies.

For technical compliance, automate as much as possible. Use SCAP scanners, CIS benchmark compliance checkers, cloud security posture management tools, and vulnerability scanners to monitor configurations against your defined baselines. Continuous monitoring beats periodic point-in-time snapshots every time.

Assign clear ownership. Managers monitor compliance within their teams. The security team runs organisation-wide assessments. Internal audit provides independent assurance. Bring in third-party specialists for areas needing specific expertise.

When you find non-compliance, document it properly: which policy or standard was violated, how severe it is, who or what is affected, and the evidence. Analyse root causes and implement corrective actions. For people issues, decide whether more training, process improvements, or disciplinary action is the right response. For technical issues, remediate and update your automation to prevent recurrence.

Report compliance status to management regularly with dashboards or reports showing trends, problem areas, and remediation progress. Use the data to inform risk assessments and prioritise security spending. Track improvement over time as a measure of how well your ISMS is working.