Key takeaways
- Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
- Management review keeps leaders engaged and the ISMS aligned with the business.
- Start here: schedule reviews at planned intervals, at least annually.
Purpose
Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
Requirement
Requirement summaryTop management shall review the organization's information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
Why it matters
Management review keeps leaders engaged and the ISMS aligned with the business.
How to implement
- Schedule reviews at planned intervals, at least annually.
- Involve top management.
- Prepare inputs in advance.
- Record outcomes.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.3.1. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your management review schedule.
Records and examples to show
- Meeting minutes showing the review happened as planned.
- Attendance records showing top management took part.
Things you should be able to show or explain
- Leadership should be able to explain the main outcomes.
How much to show: The last two reviews.
Common mistakes
- Reviews missed.
- Senior leaders absent.
- Reviews held without top management.
- No minutes.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Management review procedure
- Risk Management Policy
FAQ
Can we exclude clause 9.3.1?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
All required inputs covered and decisions recorded.