ISO 27001 management review

ISO 27001:2022 9.3 asks top management to review the ISMS at planned intervals and decide whether it is still suitable, adequate and effective (9.3.1). The review must consider a set list of inputs (9.3.2), including, since 2022, changes in what interested parties need, and its decisions must be recorded (9.3.3).

The requirement in plain English

General (ISO 27001:2022 9.3.1). Top management reviews the ISMS at intervals they plan, to make sure it still fits the organisation (suitable), is enough for what it has to do (adequate) and works (effective).

Inputs (ISO 27001:2022 9.3.2). The review must consider:

what happened to the actions agreed at earlier reviews;
what has changed, inside the organisation and around it, that affects the ISMS;
what has changed in what customers, staff, regulators and other interested parties need from the ISMS, an input added in 2022;
how security is performing, with trends: nonconformities and corrective actions, measurement results, audit results and progress on objectives;
what interested parties have told you;
where the risk assessment stands and how far the treatment plan has got;
where the ISMS could improve.

Results (ISO 27001:2022 9.3.3). The outputs are decisions about improvement opportunities and any changes the ISMS needs. You keep documented information as evidence of the results.

The new third input connects the review back to clause 4: if a big customer, a regulator or your staff now expect something different, the review is where top management decides what the ISMS does about it (ISO 27001:2022 4.2).

This is guidance to help you understand the requirement, not legal advice.

What good looks like

A 30-person payments software company holds its management review every January, with a shorter check-in in July. The CEO, CTO and head of operations attend; the security lead prepares the pack and presents it.

The pack follows the seven inputs in order, so nobody has to hunt for coverage. It is short: a page of open actions from last time, a page of changes in issues and interested parties (a new banking customer with audit rights, a new data protection expectation from an investor), trend charts for incidents, audit findings and the security objectives, and the top ten risks with their treatment status.

The minutes record decisions, each with an owner and a date: approve budget for a second hosting region, accept the residual risk on legacy reporting until Q3, change the access review from twice a year to quarterly for production, add a supplier review objective. Each decision becomes a tracked action and reappears as the first input at the next review.

The signed minutes, the pack and the action list are kept together, so an auditor can trace a decision from the minutes to its outcome.

Evidence an auditor expects

Minutes or record of the review (required documented information of results): the auditor checks the date, who attended, and that each 9.3.2 input was considered.
Decisions and actions: the auditor looks for decisions about improvement and changes, not just a list of reports noted.
Follow-up of previous actions: the auditor picks an action from the last review and asks what happened to it.
The review pack: usual rather than required; it shows where the input data came from.
Top management interview: the auditor asks a director what the review decided; vague recall suggests the review was a formality.

Common mistakes

A presentation without decisions

The security lead presents for an hour, top management says thank you, and the minutes read “noted”. Clause 9.3.3 wants decisions. End each input with a question for top management and minute the answer.

Missing the new input

Packs built from a 2013-era template often skip changes in interested parties’ needs and expectations. Auditors check for it explicitly since the transition. Add it as its own agenda item and link it to the interested parties register.

Inputs covered in name only

“Audit results: see report” is not a review of them. Summarise trends: is the number of findings rising or falling, and in which areas?

Not top management

The review is run by the security lead and the IT manager. If top management do not attend, the clause is not met however good the content. Hold it where the directors already meet, if that helps attendance.

Previous actions vanish

Actions from the previous review are never revisited. The first input exists to stop this. Start every review with the action list.

How Sted helps

For ISO 27001 clause 9.3 Sted’s knowledge base carries the Management Review Procedure (PRC-MRP) with its Management Review Schedule (REC-MRS), Management Review Record (REC-MRR) and Management Review Action Record (REC-MRA); the schedule and the review record come with a suggested annual frequency.
Nothing is scheduled until an owner picks a first due date, and records are part of the Full Management System plan.
33 periodic record types come with a suggested frequency, but nothing is scheduled until you pick a first due date.
An administrator or the owner of a record type’s document sets how often it repeats and its next due date under Repeating records; a task to complete it opens 30 days before each due date, goes to the document’s owner, and closing that period’s record moves the date on. Event-driven record types never fall due on their own.
A record is opened, completed, submitted for closure and closed (or withdrawn); closure is reviewed by the document owner.

Sted raises the review when it falls due and holds its record. The decisions are top management’s own; Sted does not attend the review or decide anything in it.

Management review guide: preparing the pack and running the meeting.
Internal audit: the audit results the review considers.
Context of the organisation: the issues and interested parties whose changes the review weighs.
Repeating records: how Sted raises the review each time it falls due.
Interested parties: who they are, and why their changing needs are now an input.
Improvement, nonconformity and corrective action: the trends the review weighs and where its decisions go.

Frequently asked questions

How often must an ISO 27001 management review happen?

At planned intervals you set yourself; the standard gives no number. Once a year is the common minimum, and certification bodies expect one before stage 2. Organisations that change quickly often hold a short review every six months.

Can the management review be part of a normal board meeting?

Yes, if top management attends, every input in clause 9.3.2 is covered and the minutes record the decisions. Many small companies run it as a dedicated agenda item with its own minutes, which makes the evidence easier to find.