ISO 27001 clauses
The meeting where leadership owns the ISMS.
Clause 9.3 asks top management to look at the ISMS at planned intervals and decide whether it is still suitable, adequate and effective. It is the one meeting where security results reach the people who control budget and priorities. Auditors read its minutes closely, because they show whether leadership is engaged or simply signing.
Back to ISO 27001 services01 · What it is for
Why the review exists
Every other loop reports upward. This is where someone with authority decides.
Metrics show how controls perform, the internal audit shows whether the system conforms, and incidents show where it breaks. None of those change anything on their own. The management review is where results meet resources and direction: more budget, a new objective, a changed scope, an accepted risk. Without it, the ISMS becomes a project the security team runs alone, and clause 5 leadership duties are hard to evidence.
02 · Inputs and decisions
What goes in, where it comes from, and what should come out
Our own summary of the topics the standard expects to be considered, with the decision each one usually prompts.
| Input | Source | Decision it should prompt |
|---|---|---|
| Status of actions from the last review | Previous minutes and action log | Close, extend or escalate each open action |
| Changes in internal and external issues | Clause 4.1 context analysis | Whether scope, risks or objectives need revising |
| Changes in interested parties' needs | Interested parties register, customer and regulator feedback | New requirements to adopt or contracts to adjust |
| Nonconformities and corrective actions | Corrective action register | Whether trends point to a systemic cause |
| Monitoring and measurement results | Clause 9.1 metrics | Where performance needs investment or a new target |
| Audit results | Internal audit reports, certification body reports | Priorities for fixes and next audit focus |
| Progress on security objectives | Clause 6.2 objectives tracker | Keep, reset or replace objectives |
| Feedback from interested parties | Customer questionnaires, complaints, staff input | Whether commitments to them are being met |
| Risk assessment results and treatment status | Risk register, treatment plan | Accept residual risk, add resources or change treatment |
| Opportunities for improvement | Audit reports, team suggestions | Which improvements to fund and when |
The required outputs come down to two kinds of decision: improvements to pursue, and changes the ISMS needs, including resources. Minutes should show both.
03 · Who and how often
Who attends, and how often
The people who can commit money and people, at intervals you set and keep.
- Must attend
- Top management for the scope in question: a founder or CEO in a small firm, or the executive accountable for the ISMS in a larger one.
- Presents
- The ISMS lead or security owner, who prepares inputs and records decisions.
- Invited as needed
- Heads of engineering, IT, HR, legal or operations, when their area has items to decide.
- Optional
- The internal auditor, to explain findings; a consultant, to advise rather than decide.
The standard asks for reviews at planned intervals and does not set a frequency. Holding at least one full review a year is common practice, and many growing companies add a shorter mid-year session. Whatever you choose, write it down and keep to it. A first full review is expected before the initial certification audit.
The review does not have to be one meeting. Some organisations cover the inputs across regular leadership meetings. That works if every input is covered within the planned interval and the minutes make that traceable.
04 · Agenda template
An agenda you can reuse
Ninety minutes is often enough for a small ISMS. Send the pack in advance.
- Open actions from the last review: status and decisions.
- Changes in the business, the market, the law and customer expectations.
- Security objectives: progress against each.
- Metrics summary: what is off track and why.
- Audit results, internal and external, and the state of corrective actions.
- Incidents and near misses since the last review.
- Risk picture: top risks, overdue treatments, residual risk to accept.
- Interested-party feedback, including customer security reviews.
- Resources: people, budget and tools the ISMS needs.
- Improvements proposed, and decisions on each.
- Actions agreed: owner and due date for every one.
05 · Minutes that pass
Minutes that satisfy an auditor
Short is fine. Vague is not.
- Date and attendees. Including the top management members present.
- Every input covered. Each agenda item recorded, even if the note is that nothing changed.
- Discussion in a line. Enough to show the topic was considered, not just listed.
- Decisions stated plainly. What was decided, not only what was said.
- Actions with owners and dates. Each one traceable to the next review.
- Resource decisions. What was granted, refused or deferred, and why.
- Approved and kept. Circulated, agreed and stored as a protected record.
06 · Decisions due
Decisions that must come out of it
If the minutes show no decisions, the review did not happen in any sense that matters.
- Whether the ISMS is still suitable, adequate and effective, stated as a conclusion.
- Which improvements to pursue, with owners.
- Changes needed to the ISMS: scope, policy, objectives, risk criteria.
- Resources to add, move or withdraw.
- Residual risks leadership accepts, by name.
- A slide deck with no minutes. The auditor has nothing to show decisions were made.
- Only the ISMS lead attends. It is a status update, not a management review.
- Inputs skipped because nothing changed. Record that it was considered and unchanged.
- Same actions carried over every time. Signals that decisions are not being followed through.
Sources: ISO/IEC 27001:2022, clause 9.3 (management review) and sub-clauses 9.3.1 to 9.3.3, with clauses 4, 5.1, 6.2 and 9.1, described in our own words. Frequency practice reflects common certification experience, not the standard's text.
Questions about the management review
Can the management review be done by email?
Possible, but hard to evidence real discussion.
Nothing in the standard requires a meeting room. But an email thread rarely shows that leadership considered each input and reached decisions. A short meeting with minutes is the easier route to an accepted record.
Who counts as top management?
Whoever directs and controls the organisation for the ISMS scope.
In a startup that is usually the founders. In a larger company with a narrow scope it can be the executive who runs that business unit. What matters is that they have authority over resources and direction for what is in scope.
What if top management cannot attend?
Reschedule, rather than hold it without them.
A review without top management is weak evidence for clauses 5 and 9.3. If a single leader is unavailable, a delegate with real decision authority can attend, and the minutes should say so.
Should the management review happen before the certification audit?
Yes. Auditors expect at least one completed review.
The certification body will want to see the ISMS operating, and a completed management review with decisions is part of that evidence. Plan it after the first internal audit so its results can be considered.
Make the review a decision meeting.
An ISO 27001 gap analysis checks your review inputs, minutes and actions against clause 9.3, and Auditify can help prepare the pack for your first one.