ISO 27001 Clause 9.3 Management Review

ISO 27001 Management Review

ISO 27001 Clause 9.3 Management Review requires an organisation to conduct a Management Review Meeting at regular intervals and follow a structure, defined agenda.

What is ISO 27001 Clause 9.3?

The ISO 27001 standard for ISO 27001 certification wants you to have management oversight that meets regularly and covers the core components of the standard. It is one of the ISO 27001 controls.

The ISO 27001 standard requires an organisation to implement information security from the top down with leadership commitment. It is part of the process of continual improvement and one of the checks and balances. ISO 27001 is not a one and done. It is expected that it is in place and operating before the certification audit and after.

ISO 27001 Clause 9.3 Purpose

The purpose of clause 9.3 is to ensure that you have management oversight of the information security management system and that you have documentary evidence to support it.

ISO 27001 Clause 9.3 Definition

This clause has now had the wording removed and wording shifted to three new separate sub clauses.

ISO 27001:2022 Clause 9.3.1 General – New clause

Top management shall review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

ISO 27001:2022 Clause 9.3.1 General

ISO 27001:2022 Clause 9.3.2 Management Review Inputs – New clause

The management review shall include consideration of:
a) the status of actions from previous management reviews;
b) changes in external and internal issues that are relevant to the information security management system;
c) changes in needs and expectations of interested parties that are relevant to the information security management system;
d) feedback on the information security performance, including trends in:
1) nonconformities and corrective actions;
2) monitoring and measurement results;
3) audit results;
4) fulfilment of information security objectives
e) feedback from interested parties;
f) results of risk assessment and status of risk treatment plan;
g) opportunities for continual improvement.

ISO 27001:2022 Clause 9.3.2 Management Review Inputs

ISO 27001:2022 Clause 9.3.3 Management Review Results – New clause

The results of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.
Documented information shall be available as evidence of the results of management reviews.

ISO 27001:2022 Clause 9.3.3 Management Review Results

ISO27001:2022 Changes to ISO 27001 Clause 9.3

There is nothing significant that has changed to the ISO 27001 Clause 9.3 Management Review in the 2022 update. The change is wording and clarification change with a change to the layout of how the requirements are presented. Rather than one clause they have split out elements into 3 sub clauses for enhanced clarity.

How to implement ISO 27001 Clause 9.3

There are many ways to conduct management reviews.

Follow the culture of your organisation on how you conduct meetings. They can be remote, they can be in person. It is best to follow the best practice of your organisation.

For detailed step by step guidance read – How to conduct an ISO 27001 Management Review Meeting

ISO 27001 Clause 9.3 Implementation Checklist

Management Review ISO 27001 Clause 9.3 Implementation Checklist

1. Plan the Review

Decide when and how often to hold management reviews. Set a regular schedule.

Challenge: Finding time for reviews can be tough. Reviews can become routine and lose their value.

Solution: Schedule reviews well in advance. Make them a priority. Keep them focused and efficient.

2. Define the Agenda

Make a clear list of topics to cover in each review. Focus on key issues.

Challenge: Agendas can become too long and unfocused. Important topics may be missed.

Solution: Keep agendas concise and relevant. Prioritise key performance indicators and risks. Get input from different teams.

3. Gather Information

Collect data and reports to inform the review. Have the facts ready.

Challenge: Gathering data can be time-consuming. Hard to make sense of large amounts of data.

Solution: Automate data collection where possible. Use clear charts and graphs. Focus on key metrics and trends.

4. Conduct the Review

Hold the management review meeting. Discuss the key issues and make decisions.

Challenge: Reviews can become dominated by a few people. Decisions may be delayed or not followed up.

Solution: Encourage everyone to participate. Keep discussions focused and productive. Document decisions clearly.

5. Review ISMS Performance

Assess how well the ISMS is working. Are the controls effective?

Challenge: Hard to be objective about performance. People may be defensive about their work.

Solution: Use clear performance indicators. Focus on learning and improvement. Be honest about strengths and weaknesses.

6. Review Risk Treatment

Check if risk treatments are working. Are risks being managed effectively?

Challenge: Risk treatments can become outdated. New risks may emerge.

Solution: Regularly review risk assessments and treatment plans. Adapt to changes in the threat landscape.

7. Consider Internal and External Issues

Think about any changes and internal issues and external issues that might affect the ISMS.

Challenge: Hard to keep track of all the changes. External factors can be unpredictable.

Solution: Monitor industry trends and regulatory changes. Conduct regular environmental scans.

8. Review Improvement Opportunities

Look for ways to improve the ISMS. Are there any gaps or weaknesses?

Challenge: People may resist change. Hard to prioritise improvement activities.

Solution: Encourage a culture of continual improvement. Focus on areas with the biggest potential impact.

9. Document the Review

Keep clear records of the management review meeting, including decisions and actions.

Challenge: Documenting everything can be time-consuming. Hard to keep records organised.

Solution: Use a simple meeting minutes template. Store records centrally. Keep documentation clear and concise.

10. Follow Up on Actions

Make sure that any agreed actions are taken and are effective.

Challenge: It’s easy to forget about follow-up. Actions may not be implemented properly.

Solution: Set deadlines for actions. Track progress and report on it. Verify that actions have achieved the desired results.

ISO 27001 Clause 9.3 Audit Checklist

Management Review ISO 27001 Clause 9.3 Audit Checklist

1. Review Meeting Frequency

Verify that management reviews are conducted at planned intervals.

Audit Technique: Examine the documented schedule for management reviews and compare it against actual meeting dates. Check attendance records to confirm participation.

2. Check Agenda Completeness

Ensure the management review agenda covers all required inputs specified in the standard.

Audit Technique: Review past management review agendas and compare them against the requirements of ISO 27001 clause 9.3. Look for inclusion of topics like ISMS performance, risk treatment effectiveness, and interested party feedback.

3. Examine Input Information

Confirm that relevant and up-to-date information is used as input to the management review.

Audit Technique: Review the reports, data, and other information used in the management review. Check for accuracy, relevance, and timeliness. Examples include performance reports, audit findings, and risk assessments.

4. Verify Management Participation

Ensure that top management actively participates in the management review process.

Audit Technique: Review attendance records for management review meetings. Interview top management personnel to gauge their involvement and understanding of the ISMS.

5. Review Meeting Minutes

Check that meeting minutes are accurate, comprehensive, and record key decisions and actions.

Audit Technique: Examine minutes from past management review meetings. Verify that they clearly document discussions, decisions made, and assigned actions.

6. Assess ISMS Performance Review

Confirm that the management review includes a thorough assessment of the ISMS’s performance against its objectives.

Audit Technique: Review performance reports and metrics presented during the management review. Check for evidence of analysis and evaluation of ISMS effectiveness.

7. Evaluate Risk Treatment Review

Verify that the effectiveness of risk treatments is reviewed and discussed during the management review.

Audit Technique: Examine records of risk assessments, risk treatment plans, and any changes made to them as a result of the management review.

8. Check Consideration of Internal/External Issues

Ensure that internal and external issues relevant to the ISMS are considered during the review.

Audit Technique: Review meeting minutes and other documentation to confirm that Internal issues (e.g., organisational changes) and external issues (e.g., new legislation) are discussed and their potential impact on the ISMS is assessed.

9. Verify Action Follow-up

Confirm that actions arising from management reviews are tracked, implemented, and their effectiveness verified.

Audit Technique: Review action logs, implementation records, and any follow-up reviews conducted to assess the effectiveness of corrective actions.

10. Examine Record Keeping

Ensure that records of management reviews, including minutes, reports, and action plans, are maintained and readily accessible.

Audit Technique: Check the organisation’s document management system for the presence and accessibility of management review records. Verify that they are stored securely and for the required retention period.

Watch the Tutorial

Watch How to implement ISO 27001 Clause 9.3 Management Review | Step-by-Step Guide

ISO 27001 Management Review Template

What the auditor will check

The auditor is going to check a number of areas for compliance with Clause 9.3. Lets go through them

1. That roles are defined and assigned

The auditor will look for evidence that you have defined the roles for the management review team. They will want to see representation for the in scope areas. For best practice they will be looking for one representative of each in scope department, at least one member of senior leadership, deputies for everyone.

2. That management meetings have happened and are planned

They will be looking to see that management reviews have taken place and that future management reviews are planned in. It is likely to be the case that they will look for calendar entries and also, most important of all, they are looking for minutes and documentation of those management reviews.

Common ISO 27001 Clause 9.3 Mistakes

In my experience, the top 4 mistakes people make for ISO 27001 Management Review are:

• Not having minutes or documentation of management reviews happening
• People, including deputies, not attending management review meetings
• No planning ahead to evidence that reviews will happen in the future
• Not following the structured, defined agenda with no evidence that the provided agenda items were covered.

ISO 27001 Clause 9.3 FAQ