Key takeaways
- Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
- Reviews should lead to decisions on improvement and change.
- Start here: record decisions on improvements and ISMS changes.
Purpose
Top management reviews the ISMS regularly, considering defined inputs and producing decisions on improvements and changes.
Requirement
Requirement summaryThe results of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system. Documented information shall be available as evidence of the results of management reviews.
Why it matters
Reviews should lead to decisions on improvement and change.
How to implement
- Record decisions on improvements and ISMS changes.
- Assign actions with owners and dates.
- Track actions to completion.
- Keep minutes as evidence.
What evidence you need to provide
Here is what you will typically need to provide for Clause 9.3.3. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your management review minutes with decisions and actions.
Records and examples to show
- Actions with owners and deadlines, and proof of progress.
- Decisions on changes to the programme and resources needed.
Things you should be able to show or explain
- Be able to explain what changed because of the last review.
How much to show: The last review's actions.
Common mistakes
- No decisions recorded.
- Actions never completed.
- Reviews with no decisions recorded.
- Actions never followed up.
- Tip: Do a full internal audit and a management review before your Stage 2 audit.
Policies & documents to have
- Management review procedure
FAQ
Can we exclude clause 9.3.3?
No. Clauses 4–10 are mandatory for certification; only Annex A controls can be excluded, with justification.
What do auditors look for?
All required inputs covered and decisions recorded.