Measure · ISO 27001
Check security rules in actual operation
Compare an applicable internal rule with actual practice and correct exceptions effectively in the existing record.
Reuse existing records
Reuse access reviews, configuration checks and operational samples. Keep the result and correction in the same review, Finding or ticket.
What to do
- 1
Choose the rule and suitable check
Identify the current requirement, affected inventory and responsible role. Arrange suitable regular checks using existing controls. Automated measurement or reports can reduce the work.
- 2
Compare actual application
Check a suitable current scope against the requirement. Record the version, sample and result in the existing record. A signed policy or training certificate alone does not show compliance.
- 3
Follow causes and effectiveness
Identify the cause, decide necessary corrections, implement them and verify effectiveness. Work according to risk. If correction is still open at the next review, at least assess progress. Keep results available for independent reviews.
Worked example
An operational example
Fictional example: The internal rule requires MFA for external access. The service owner compares this rule against active account settings.
- Non-compliant account
- DecisionThe existing IT record contains the cause, enabled MFA and a checked successful authentication path.
- EvidenceReview scope, result and effective correction in the same record.
Record the result
- Applicable rule and traceable comparison against actual practice.
- Recorded causes, corrections and effectiveness checks for exceptions.
Common implementation mistakes
Confusing policy review with operational checks
A suitable approved policy is addressed by A.5.1. This workflow checks whether the relevant operation actually follows it.
Related requirement
The references below show which requirements the measure contributes to.
View controls and standards
- A.5.36 · Einhaltung von Richtlinien, Regeln und Standards für die InformationssicherheitGerman guide
The workflow supports regular owner checks of internal rules, causes, implementation and effectiveness of corrections, and retained results.
