ISO27001 Clause 9.3 Certification Guide | Management Review

What is ISO 27001 Clause 9.3 Management Review?

ISO 27001 Clause 9.3 Management Review requires an organisation to conduct a Management Review Meeting at regular intervals and follow a structure, defined agenda.

The ISO 27001 standard for ISO 27001 certification wants you to have management oversight that meets regularly and covers the core components of the standard. It is one of the ISO 27001 controls.

The ISO 27001 standard requires an organisation to implement information security from the top down with leadership commitment. It is part of the process of continual improvement and one of the checks and balances. ISO 27001 is not a one and done. It is expected that it is in place and operating before the certification audit and after.

What are the ISO 27001:2022 Changes to Clause 9.3?

There is nothing significant that has changed to the ISO 27001 Clause 9.3 Management Review in the 2022 update. The change is wording and clarification change with a change to the layout of how the requirements are presented. Rather than one clause they have split out elements into 3 sub clauses for enhanced clarity.

ISO27001:2022 Clause 9.3 Management Review

This clause has now had the wording removed and wording shifted to three new separate sub clauses.

ISO27001:2022 Clause 9.3.1 General – New clause

Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

ISO27001:2022 Clause 9.3.2 Management Review Inputs – New clause

The management review shall include consideration of:

a) the status of actions from previous management reviews;

b) changes in external and internal issues that are relevant to the information security management system;

c) changes in needs and expectations of interested parties that are relevant to the information security management system;

d) feedback on the information security performance, including trends in:

1) nonconformities and corrective actions;

2) monitoring and measurement results;

3) audit results;

4) fulfilment of information security objectives

e) feedback from interested parties;

f) results of risk assessment and status of risk treatment plan;

g) opportunities for continual improvement.

ISO27001:2022 Clause 9.3.3 Management Review Results – New clause

The results of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.

Documented information shall be available as evidence of the results of management reviews.

ISO27001 Clause 9.3 Definition

We include the 2013 version of the clause here.

The ISO 27001:2013 standard defined clause 9.3 as follows:

Top management shall review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

The management review shall include consideration of:

a) the status of actions from previous management reviews
b) changes in external and internal issues that are relevant to the information security management system
c) feedback on the information security performance, including trends in:
1) nonconformities and corrective actions;
2) monitoring and measurement results;
3) audit results; and
4) fulfilment of information security objectives
d) feedback from interested parties
e) results of risk assessment and status of risk treatment plan; and
f ) opportunities for continual improvement.
The outputs of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.
The organisation shall retain documented information as evidence of the results of management reviews.

ISO 27001:2013 Clause 9.3 Management Review

How to conduct an ISO 27001 Management Review

We have provide a detailed guide on How to conduct an ISO 27001 Management Review Meeting

How to comply with ISO 27001 Clause 9.3

ISO 27001 Clause 9.3 Implementation Guide

There are many ways to conduct management reviews.

Follow the culture of your organisation on how you conduct meetings. They can be remote, they can be in person. It is best to follow the best practice of your organisation.

Good practice also includes allocate roles within the meeting to keep the meeting on track. This is not a requirement of the standard but good practice.

Consider allocating the role of a time keeper to keep you on time, a minute taker responsible for the minutes and meeting chair to guide and chair the meeting.

How do you demonstrate compliance to ISO 27001 clause 9.3?

You demonstrate compliance to ISO 27001 Clause 9.3 Management Review by having a management review meeting scheduled and in the calendar.

In addition you will have past meetings minutes available for review. Those meeting minutes will have have followed the structure and requirements of the ISO 27001 standard.

ISO 27001 Clause 9.3 Template

ISO 27001 templates are a great way to implement your information security management system. Whilst an ISO 27001 toolkit can save you up to 30x in consulting fees and allow you to deliver up to 10x faster these individual templates help meet the specific requirements of ISO 27001 clause 9.3

ISO 27001 Clause 9.3 FAQ

Reference

ISO/IEC 27001 Information Security Management