Management review: general
Top management must review the organization's ISMS at planned intervals to make sure it remains suitable, adequate and effective.
What the requirement asks
Top management must review the organization's ISMS at planned intervals to make sure it remains suitable, adequate and effective.
What the guidance adds
The management review is expected to happen at planned intervals and to cover the whole system. The guidance asks for the inputs, the discussion and the decisions, not a slide pack with no record of what was decided.
Status of the guidance. The guidance lens for 9.3.1 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep A schedule of management reviews at planned intervals with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Management reviewA schedule of management reviews at planned intervals
- Management reviewMinutes showing top management attendance
- Management reviewA recorded conclusion on whether the ISMS is still suitable, adequate and effective
- Management reviewEvidence reviews happened as planned
The question an assessor will ask
An assessor will ask for A schedule of management reviews at planned intervals. The test for 9.3.1 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Reviews are held by the security team without top management
- Reviews are skipped or postponed indefinitely
- No conclusion on ISMS suitability, adequacy and effectiveness is recorded
- Planned intervals are not defined
Before the next audit
Before the next audit, test this against one live record: reviews are held by the security team without top management.