Skip to main content
All measures

Measure · ISO 27001 and other standards

Prepare and record management review

Bring current ISMS inputs together for top management, record its actual review and decisions, and follow up actions in existing records.

Accountable: Top management with the ISMS coordinator preparing the reviewReviewed

Reuse existing records

Use handbook chapter 9 and existing risks, objectives, audit reports and task statuses. A suitable existing management record replaces the result template entirely.

What to do

  1. 1

    Set the timing and authoritative result record

    Plan suitable intervals, preparation responsibilities and the actual participation of top management. Define where the review and results will be retained. Use the template only if an existing management record does not already contain the necessary information.

  2. 2

    Evaluate current inputs

    Bring together earlier action statuses, changes in context and relevant expectations, and trends in information security performance. Include nonconformities and corrective actions, measurements, audit results and objective achievement. Also consider interested-party feedback, risk assessment and treatment plan status, and improvement opportunities. Reference the authoritative records and evaluate their development rather than copying them.

  3. 3

    Record leadership conclusions and follow up

    Top management assesses the continuing suitability, adequacy and effectiveness of the ISMS. Record its decisions on improvements and necessary changes. Link agreed work with ownership and deadlines in the existing task record and resolve resource needs. Include progress in the next review. The authoritative handbook process continues to govern nonconformity handling.

Worked example

A security objective remains below the agreed target

Fictitious example: the current evaluation shows that some planned access reviews remain open. The audit and risk register provide the relevant context.

Input and evaluation
DecisionManagement considers the measured state, impacts and previous remedies together with current risk and audit information.
EvidenceIdentified sources and their actual evaluation in the result record.
Decision and follow-up
DecisionManagement changes responsibility and provides the necessary capacity. Work is followed up in the existing record.
EvidenceLeadership decision with ownership, deadline and reference to the next review.

Record the result

  • Review period, actual top management participation and traceable evaluation of inputs.
  • Recorded leadership results on improvements and necessary changes, with references to agreed follow-up work.

Common implementation mistakes

Treating a collection of links as a review

Evaluate the sources. Record what management concludes and decides about the ISMS.

Replacing top management with a tool status

A status, agenda or dashboard is not evidence that management review actually took place.

Reuse the implementation across requirements

The references below show which requirements the measure contributes to.

View controls and standards

  • ISO/IEC 27001 · 9.3.1

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The record identifies the review date, period considered and top management actually participating. It prepares a reasoned conclusion on continuing suitability, adequacy and effectiveness. Suitable planned intervals and the actual review by management must be ensured organisationally.

    Reference

  • ISO/IEC 27001 · 9.3.2

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    Seven input groups connect authoritative information with its evaluation. Performance trends explicitly include nonconformities and corrective actions, monitoring and measurement, audit results and objective achievement. The user must obtain all actually relevant inputs, evaluate their development and retain a retrievable record of the state considered. A list of links alone is insufficient.

    Reference

  • ISO/IEC 27001 · 9.3.3

    ISO/IEC 27001:2022 + Amd 1:2024 · Supporting contribution

    The result fields record management decisions on improvement opportunities and necessary ISMS changes and the references to agreed work. The conclusion makes the result and participating management traceable. Actual decisions, appropriate document control and implementation of follow-up work remain with the user.

    Reference

Templates for your implementation

Sources and further reading