ISO/IEC 27001:2022 · derived mapping target
A.5.36Compliance with policies, rules and standards for information security
Regularly check that staff and systems actually comply with your security policies and standards, and follow up where they fall short. Written rules only protect you if they are followed.
Mapping at a glance
A.5.36Compliance with policies, rules and standards for information securityISO/IEC 27001:2022
A.5.36 is covered by 28 Sekit CSF controls. +23 more in the table below. Open in the full graph →
Mapped from the Sekit CSF
The Sekit controls that cover this requirement, lens by lens.
RCF-0002Policy management · ProcesssupportsThis process control runs a recurring routine that puts security policies in front of every employee and verifies they are followed, the operational check A.5.36 requires.RCF-0003Policy management · TechnicalsupportsThis technical control configures systems to enforce key policy rules automatically, giving A.5.36's compliance check a mechanism that does not depend on staff goodwill.RCF-0011Risk treatment · ProcesssupportsThis process control tracks agreed risk actions to completion within their deadlines, the follow-through A.5.36 expects after a treatment decision is made.RCF-0012Risk treatment · TechnicalsupportsThis technical control verifies that each agreed risk measure is genuinely configured and working in the live environment, confirming compliance A.5.36 checks for rather than assuming it.RCF-0013Exception management · PolicyenablesThis policy control defines in writing how deviations from security policy are requested, approved and time-limited, the exception path A.5.36's compliance checking must account for.RCF-0014Exception management · ProcesssupportsThis process control runs exception approvals through a consistent, recorded flow and revisits every exception before it expires, the discipline A.5.36 checks compliance against.RCF-0017Regulatory compliance · ProcesssupportsThis process control carries out each legal obligation's recurring activities consistently across the company, the compliance behaviour A.5.36 verifies is genuinely happening.RCF-0019Metrics & reporting · PolicyenablesThis policy control defines a small set of security indicators, who produces them and what triggers action, the measurement basis A.5.36's compliance monitoring relies on.RCF-0023Internal audit · ProcesssupportsThis process control tracks every audit finding to closure within its agreed deadline, escalating overdue items to leadership, the exact compliance-checking activity A.5.36 requires.RCF-0031Control testing program · PolicyenablesThis policy control defines in writing which controls get tested, how often and by whom, the testing programme A.5.36's compliance verification depends on.RCF-0032Control testing program · ProcesssupportsThis process control runs planned control tests on schedule and turns every failure into a tracked remediation action, the follow-through A.5.36 requires of compliance testing.RCF-0034Issues management · PolicyenablesThis policy control keeps a written rule that every security issue is logged in one place and tracked until closed, the record A.5.36's compliance checking relies on.RCF-0050Ownership & custodians · ProcesssupportsThis process control has each asset owner periodically confirm their assets are correctly inventoried and in an acceptable security state, one recurring compliance check under A.5.36.RCF-0224Configuration management · ProcesssupportsThis process control reviews deployed configurations against approved standards on a recurring basis and corrects deviations found, a direct instance of the compliance checking A.5.36 requires.RCF-0227Baseline compliance · ProcesssupportsThis process control monitors baseline compliance continuously and brings non-compliant systems back within standard inside the agreed window, matching A.5.36's requirement to follow up on non-compliance.RCF-0245Backup coverage · ProcessrelatedThis process control reviews backup scope on a recurring basis so every critical system is genuinely being backed up, the kind of compliance check A.5.36 expects across technical domains.RCF-0373Control evidence management · PolicyenablesThis policy control states in writing which controls require retained evidence, where it lives and how long it is kept, the evidence standard A.5.36's compliance checking is built on.RCF-0374Control evidence management · ProcesssupportsThis process control collects and files control evidence as work happens, named and dated consistently, so any control's operation can be demonstrated on demand under A.5.36.RCF-0376Compliance calendar · PolicyenablesThis policy control keeps one centralised, approved schedule of every recurring compliance obligation with a deadline and named owner, the tracking backbone A.5.36 checks against.RCF-0377Compliance calendar · ProcesssupportsThis process control works the compliance calendar actively, reminding owners ahead of deadlines and reviewing misses rather than absorbing them silently, the follow-up A.5.36 requires.RCF-0379Regulatory mapping · PolicyenablesThis policy control maintains an approved register of every law and framework applying to the company, mapped to the controls that satisfy it, the map A.5.36 checks compliance against.RCF-0380Regulatory mapping · ProcesssupportsThis process control turns each regulatory requirement into a concrete, owned obligation and reworks the mapping as regulations or the business change, keeping A.5.36's compliance basis current.RCF-0381Regulatory mapping · TechnicalenablesThis technical control holds the requirement-to-control mapping in a tool that stays current and flags obligations lacking a covering control, supporting the visibility A.5.36's compliance checking needs.RCF-0382Audit readiness · PolicyenablesThis policy control commits in writing to continuous audit readiness with defined scope, current evidence and named response roles, the readiness posture A.5.36's compliance checking supports.RCF-0383Audit readiness · ProcesssupportsThis process control runs readiness as a rhythm of periodic internal spot-checks that confirm evidence is current and findings are fixed before an external party asks, reinforcing A.5.36.RCF-0385Corrective action tracking · PolicyenablesThis policy control requires every audit finding or compliance gap to be logged with an owner, target date and closure criterion, the standard A.5.36's compliance checking enforces.RCF-0386Corrective action tracking · ProcesssupportsThis process control tracks every open corrective action through to closure with regular status reporting, the exact follow-through A.5.36 expects of compliance findings.RCF-0387Corrective action tracking · TechnicalsupportsThis technical control configures a tracking tool so corrective actions generate automatic reminders and escalate overdue items to management, automating the follow-up A.5.36 requires.
NIST CSF 2.0 counterparts
Reached through the Sekit CSF controls both map to — a mapping, not a formal equivalence.
ISO/IEC 42001:2023 — Annex A counterparts
Cyber Essentials counterparts
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Internal audit report
The output of the internal reviews the company runs on its own security controls, with findings and improvement actions.
Audit evidence and corrective actions log
The file where proof that controls work is kept, plus the tracking of audit findings through to closure.
From the Sekit evidence catalog
In practice
In practice this control functions as the company's checking layer: a recurring cycle of internal audits, control tests and configuration reviews that catches drift between written policy and what people do day to day. Auditors ask for the internal audit report and the corrective action log together, then trace one finding from discovery to closure. The common failure mode is a compliance programme that produces findings nobody tracks to resolution, so the same gap reappears at every review because nothing forces it shut.
Common gaps
Internal audit findings are logged but nobody owns closing them, so the same finding reappears in the next audit cycle unresolved.
Policy exceptions get approved once and never revisited, so expired exceptions quietly become permanent unwritten changes to the rule.
The regulatory mapping register lists which law applies but nobody rechecked it against the current control set in over a year.
Questions your auditor will ask
How do you track an audit finding from discovery to closure?
The audit evidence and corrective actions log names an owner and a deadline for each finding, and overdue items escalate to leadership.
Who signs off when a security control test finds a failure?
The control testing program assigns a named owner and target date to every failed test, tracked in the corrective action log until closed.
How current is the mapping between regulations and internal controls?
The regulatory mapping register is reworked whenever a regulation or the business changes, and a live tool flags any obligation without a covering control.
What happens when staff do not follow an approved security policy?
Compliance monitoring routines flag the deviation, and it is logged as an issue with an owner until either the practice or the policy is corrected.
Where regulation demands it
NIS2 2.2 requires ongoing compliance monitoring, the exact discipline this control's audits, control tests and configuration reviews carry out.
ENS org.3 requires documented security procedures, the baseline this control verifies are followed across the company.
Related controls
Via the shared Sekit CSF topic, not the framework's own index.
Ask Sekura: “What evidence proves A.5.36?”
Also via MCP, free with account