Management review results
The outputs of management review must include decisions on opportunities for continual improvement and on any need to change the ISMS, and documented information must be available as evidence of the review results.
What the requirement asks
The outputs of management review must include decisions on opportunities for continual improvement and on any need to change the ISMS, and documented information must be available as evidence of the review results.
What the guidance adds
The outputs are expected to record decisions on improvement, changes to the system and resource needs. The guidance asks who owns each decision and when it will be done. An output that says 'continue to monitor' is not a decision.
Status of the guidance. The guidance lens for 9.3.3 reads the draft, which is at stage 40.00 and is not published, against the published ISO/IEC 27001:2022 requirement above. It is our reading, not a quotation, and it is not a requirement.
What good looks like
Keep minutes recording decisions on improvement opportunities and ISMS changes with the clause record, and give it an owner and a review date.
Evidence an assessor asks for
- Review outputsMinutes recording decisions on improvement opportunities and ISMS changes
- Review outputsAn action log from the review with owners and dates
- Review outputsEvidence that decisions were implemented
- Review outputsRetained records of review results
The question an assessor will ask
An assessor will ask for minutes recording decisions on improvement opportunities and ISMS changes. The test for 9.3.3 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.
Common gaps
- Minutes record discussion but no decisions
- Actions have no owner or due date
- Decisions are not followed up at the next review
- Records of results are not retained
Before the next audit
Before the next audit, test this against one live record: minutes record discussion but no decisions.