[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-36":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-36","Annex A 5.36","Compliance with policies, rules and standards for information security",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Regularly check that the organisation's information security policy, topic-specific policies, rules and standards are actually being followed.\n\n**In practice.** Managers review compliance in their own areas, supported by technical checks such as configuration scanning, access reviews and policy as code. Where non-compliance is found, causes are analysed, corrective actions are agreed and tracked, and results are reported upwards. Formal exceptions are recorded with a risk owner and expiry date. Auditors look for a compliance monitoring schedule, results of reviews and scans, an exception register and evidence that actions were closed.\n\n**Common gaps.** Policies are often written and published but never measured, so nobody knows the actual compliance level. Exceptions are granted informally by email and never revisited, and technical baselines drift without being detected.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]