Key takeaways
- Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
- Reviews must consider specific inputs to be meaningful.
- Start here: cover previous actions, changes in context and interested party needs.
Purpose
Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
Requirement
Requirement summaryThe management review shall include consideration of: a) the status of actions from previous management reviews; b) changes in external and internal issues that are relevant to the information security management system; c) changes in needs and expectations of interested parties that are relevant to the information security management system; d) feedback on the information security performance, including trends in: 1) nonconformities and corrective actions; 2) monitoring and measurement results; 3) audit results; 4) fulfilment of information security objectives; e) feedback from interested parties; f) results of risk assessment and status of risk treatment plan; g) opportunities for continual improvement.
Why it matters
Reviews must consider specific inputs to be meaningful.
How to implement
- Cover previous actions, changes in context and interested party needs.
- Include performance trends: nonconformities, metrics, audits, objectives.
- Consider risk assessment results and improvement opportunities.
- Prepare a standard agenda covering all inputs.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.3.2. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your management review agenda covering all required topics.
Records and examples to show
- Minutes showing each topic was discussed, including changes in issues and interested parties, results of measures, audits, incidents and feedback.
- Input packs or reports prepared for the meeting.
Things you should be able to show or explain
- Be able to explain how inputs are gathered.
How much to show: The last review.
Common mistakes
- Required topics skipped.
- Little or no data presented.
- Missing required inputs.
- Presenting data without discussion.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Management review procedure
FAQ
Can we exclude clause 9.3.2?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
All required inputs covered and decisions recorded.