ISO 27001 Management Review requires an organisation to conduct a Management Review Meeting at regular intervals and follow a structure, defined agenda. By doing this we can ensure we have an effective information security management system that is achieving it’s intended outcomes.
In ISO 27001 this is known as ISO27001:2022 Clause 9.3 Management Review. It is one of the mandatory ISO 27001 clauses.
The requirement is that the management review
- Reviews the status of actions from previous management reviews
- Records changes in external and internal issues that are relevant to the information security management system
- Records changes in needs and expectations of interested parties that are relevant to the information security management system
- Reviews the information security performance
- Ensures the fulfilment of information security objectives
- Takes account of feedback from interested parties
- Oversees the results of risk assessment and status of risk treatment plan
- Reviews opportunities for continual improvement
Key Takeaways
- The ISO 27001 standard requires an organisation to implement information security from the top down with leadership commitment and oversight.
- It is part of the process of continual improvement and one of the checks and balances.
- ISO 27001 is not a one and done and requires ongoing management.
- It is called ISO27001:2022 Clause 9.3 Management Review
Table of contents
ISO27001:2022 Clause 9.3 Management Review
The purpose of clause 9.3 is to ensure that you have management oversight of the information security management system and that you have documentary evidence to support it.
This clause has now had the wording removed and wording shifted to three new separate sub clauses.
ISO 27001:2022 Clause 9.3.1 General
Top management shall review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
ISO 27001:2022 Clause 9.3.1 General
ISO 27001:2022 Clause 9.3.2 Management Review Inputs
The management review shall include consideration of:
ISO 27001:2022 Clause 9.3.2 Management Review Inputs
a) the status of actions from previous management reviews;
b) changes in external and internal issues that are relevant to the information security management system;
c) changes in needs and expectations of interested parties that are relevant to the information security management system;
d) feedback on the information security performance, including trends in:
1) nonconformities and corrective actions;
2) monitoring and measurement results;
3) audit results;
4) fulfilment of information security objectives
e) feedback from interested parties;
f) results of risk assessment and status of risk treatment plan;
g) opportunities for continual improvement.
ISO 27001:2022 Clause 9.3.3 Management Review Results – New clause
The results of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.
ISO 27001:2022 Clause 9.3.3 Management Review Results
Documented information shall be available as evidence of the results of management reviews.
ISO27001:2022 Changes to ISO 27001 Clause 9.3
There is nothing significant that has changed to the ISO 27001 Clause 9.3 Management Review in the 2022 update. The change is wording and clarification change with a change to the layout of how the requirements are presented. Rather than one clause they have split out elements into 3 sub clauses for enhanced clarity.
DO IT YOURSELF ISO27001
STOP SPANKING £10,000s on CONSULTANTS and ISMS ONLINE PLATFORMS
Implementation Guide
There are many ways to conduct management reviews.
Follow the culture of your organisation on how you conduct meetings. They can be remote, they can be in person. It is best to follow the best practice of your organisation.
For detailed step by step guidance read – How to conduct an ISO 27001 Management Review Meeting
Time needed: 1 hour and 30 minutes
How to implement ISO 27001 Clause 9.3 Management Review
- Decide who will attend the ISO 27001 Management Review Meeting
Decide who will attend the ISO 27001 management review team meetings. It should include the information security manager, a member of the senior leadership team and members from each department in the organisation. This should then be documented in your roles and responsibilities documentation. Make sure that the members are added to the competency matrix.
- Create your meeting agenda and book your meetings
Create your ISO 27001 Management Review Meeting agenda based on the requirements of the standard, including all mandatory topics.
- Schedule your ISO 27001 Management Review Meetings for the year
Forward plan and schedule your meetings for the year.
- Conduct your meetings keeping minutes
Conduct your ISO 27001 Management Review Meetings and be sure to minute and keep copies of minutes.
ISO 27001 Management Review Template
The ISO 27001 Management Review Template is the mandatory ISO 27001 Management Review agenda and comes with a detailed step-by-step guide on how to do a management review.
Implementation Checklist
Management Review ISO 27001 Clause 9.3 Implementation Checklist
1. Plan the Review
Decide when and how often to hold management reviews. Set a regular schedule.
Challenge
Finding time for reviews can be tough. Reviews can become routine and lose their value.
Solution
Schedule reviews well in advance. Make them a priority. Keep them focused and efficient.
2. Define the Agenda
Make a clear list of topics to cover in each review. Focus on key issues.
Challenge
Agendas can become too long and unfocused. Important topics may be missed.
Solution
Keep agendas concise and relevant. Prioritise key performance indicators and risks. Get input from different teams.
3. Gather Information
Collect data and reports to inform the review. Have the facts ready.
Challenge
Gathering data can be time-consuming. Hard to make sense of large amounts of data.
Solution
Automate data collection where possible. Use clear charts and graphs. Focus on key metrics and trends.
4. Conduct the Review
Hold the management review meeting. Discuss the key issues and make decisions.
Challenge
Reviews can become dominated by a few people. Decisions may be delayed or not followed up.
Solution
Encourage everyone to participate. Keep discussions focused and productive. Document decisions clearly.
5. Review ISMS Performance
Assess how well the ISMS is working. Are the controls effective?
Challenge
Hard to be objective about performance. People may be defensive about their work.
Solution
Use clear performance indicators. Focus on learning and improvement. Be honest about strengths and weaknesses.
6. Review Risk Treatment
Check if risk treatments are working. Are risks being managed effectively?
Challenge
Risk treatments can become outdated. New risks may emerge.
Solution
Regularly review risk assessments and treatment plans. Adapt to changes in the threat landscape.
7. Consider Internal and External Issues
Think about any changes and internal issues and external issues that might affect the ISMS.
Challenge
Hard to keep track of all the changes. External factors can be unpredictable.
Solution
Monitor industry trends and regulatory changes. Conduct regular environmental scans.
8. Review Improvement Opportunities
Look for ways to improve the ISMS. Are there any gaps or weaknesses?
Challenge
People may resist change. Hard to prioritise improvement activities.
Solution
Encourage a culture of continual improvement. Focus on areas with the biggest potential impact.
9. Document the Review
Keep clear records of the management review meeting, including decisions and actions.
Challenge
Documenting everything can be time-consuming. Hard to keep records organised.
Solution
Use a simple meeting minutes template. Store records centrally. Keep documentation clear and concise.
10. Follow Up on Actions
Make sure that any agreed actions are taken and are effective.
Challenge
It’s easy to forget about follow-up. Actions may not be implemented properly.
Solution
Set deadlines for actions. Track progress and report on it. Verify that actions have achieved the desired results.
Watch the Tutorial
Watch How to implement ISO 27001 Clause 9.3 Management Review | Step-by-Step Guide
What the auditor will check
The auditor is going to check a number of areas for compliance with Clause 9.3. Lets go through them
1. That roles are defined and assigned
The auditor will look for evidence that you have defined the roles for the management review team. They will want to see representation for the in scope areas. For best practice they will be looking for one representative of each in scope department, at least one member of senior leadership, deputies for everyone.
2. That management meetings have happened and are planned
They will be looking to see that management reviews have taken place and that future management reviews are planned in. It is likely to be the case that they will look for calendar entries and also, most important of all, they are looking for minutes and documentation of those management reviews.
Audit Checklist
Management Review ISO 27001 Clause 9.3 Audit Checklist
1. Review Meeting Frequency
Verify that management reviews are conducted at planned intervals.
Audit Technique
Examine the documented schedule for management reviews and compare it against actual meeting dates. Check attendance records to confirm participation.
2. Check Agenda Completeness
Ensure the management review agenda covers all required inputs specified in the standard.
Audit Technique
Review past management review agendas and compare them against the requirements of ISO 27001 clause 9.3. Look for inclusion of topics like ISMS performance, risk treatment effectiveness, and interested party feedback.
3. Examine Input Information
Confirm that relevant and up-to-date information is used as input to the management review.
Audit Technique
Review the reports, data, and other information used in the management review. Check for accuracy, relevance, and timeliness. Examples include performance reports, audit findings, and risk assessments.
4. Verify Management Participation
Ensure that top management actively participates in the management review process.
Audit Technique
Review attendance records for management review meetings. Interview top management personnel to gauge their involvement and understanding of the ISMS.
5. Review Meeting Minutes
Check that meeting minutes are accurate, comprehensive, and record key decisions and actions.
Audit Technique
Examine minutes from past management review meetings. Verify that they clearly document discussions, decisions made, and assigned actions.
6. Assess ISMS Performance Review
Confirm that the management review includes a thorough assessment of the ISMS’s performance against its objectives.
Audit Technique
Review performance reports and metrics presented during the management review. Check for evidence of analysis and evaluation of ISMS effectiveness.
7. Evaluate Risk Treatment Review
Verify that the effectiveness of risk treatments is reviewed and discussed during the management review.
Audit Technique
Examine records of risk assessments, risk treatment plans, and any changes made to them as a result of the management review.
8. Check Consideration of Internal/External Issues
Ensure that internal and external issues relevant to the ISMS are considered during the review.
Audit Technique
Review meeting minutes and other documentation to confirm that Internal issues (e.g., organisational changes) and external issues (e.g., new legislation) are discussed and their potential impact on the ISMS is assessed.
9. Verify Action Follow-up
Confirm that actions arising from management reviews are tracked, implemented, and their effectiveness verified.
Audit Technique
Review action logs, implementation records, and any follow-up reviews conducted to assess the effectiveness of corrective actions.
10. Examine Record Keeping
Ensure that records of management reviews, including minutes, reports, and action plans, are maintained and readily accessible.
Audit Technique
Check the organisation’s document management system for the presence and accessibility of management review records. Verify that they are stored securely and for the required retention period.
Common Mistakes
In my experience, the top 4 mistakes people make for ISO 27001 Management Review are:
- Not having minutes or documentation of management reviews happening
- People, including deputies, not attending management review meetings
- No planning ahead to evidence that reviews will happen in the future
- Not following the structured, defined agenda with no evidence that the provided agenda items were covered.
FAQ
ISO 27001 Clause 9.3 Management Review requires an organisation to hold a regular management review meeting that follows the structure and requirements of the ISO 27001 standard.
ISO 27001 Clause 9.3 Management Review compliance is evidenced by having Management Review Meetings scheduled through out the year and evidence that meetings have occurred with meeting minutes available.
You can download ISO 27001 Clause 9.3 Management Review in the ISO 27001 Toolkit.
An example of ISO 27001 Clause 9.3 Management Review can be found in the ISO 27001 Toolkit.
You perform ISO 27001 management reviews monthly. If you cannot then at least once every 3 months.
The information security manager ensures that the meeting takes place. The meeting is attended by the information security manager, senior leadership representative and representatives from each department in the organisation.
Management reviews are reported to the senior leadership team.
If you do not do ISO 27001 management reviews and minute them then you will not achieve ISO 27001 certification. In addition your management system will not operate as intended and will not be effective.
Related ISO 27001 Controls
ISO 27001 Understanding The Organisation And Its Context: Clause 4.1
ISO 27001 Understanding The Needs And Expectations of Interested Parties: Clause 4.2
ISO 27001 Continual Improvement: Clause 10.1
ISO 27001 Management Responsibilities: Annex A 5.4
