.png)
.avif)
ISO 27001:2013 Requirements: Clause 9.3 Management Review (2013)
This version of ISO 27001 Clause 9.3 is applicable to ISO 27001:2013.
The purpose of the management review is ensure that the ISMS is suitable, effective and adequate to support information security. A management review consists of the status of actions from the previous management reviews, any changes in the internal or external issues that are relevant to the ISMS. It also includes the management feedback related to information security performance including trends in nonconformities and corrective actions, monitoring and measurement results, audit results and fulfilment of information security objectives. The review includes feedback from the interested parties and the results from the risk assessment process and risk treatment process.
{{snapshot}}
What a 2013 management review covers
- Management review confirms the ISMS is suitable, effective and adequate to support information security.
- Inputs include the status of actions from previous reviews and any changes in internal or external issues.
- It weighs information security performance — nonconformities, corrective actions, monitoring results, audit results and objectives.
- It also draws on interested-party feedback and the results of the risk assessment and risk treatment processes, part of the wider ISO 27001 requirements.
{{/snapshot}}
Management reviews are one of the key elements of the ISMS because of the top management role in the organisation. So, for instance, if information security needs more budget urgently due to an unplanned risk, the top management can make this possible.
| Point | What it requires |
|---|---|
| Point 1 | The purpose of the management review is ensure that the ISMS is suitable, effective and adequate to support information security. |
| Point 2 | Management reviews are one of the key elements of the ISMS because of the top management role in the organisation. |
{{snapshot}}
What Hicomply recommends
Management reviews only work when leadership sees a true picture, so keep your evidence current between reviews rather than rebuilding it the night before. Pulling audit findings, risks and corrective actions into one continuous record turns the review into a decision-making forum instead of a status update. Explore the related clauses in our ISO 27001 hub, or see it in action on a platform tour.
{{/snapshot}}
Ready to Take Control of Your Privacy Compliance?
See how Hicomply can accelerate your path to CAF compliance in a 15-minute demo.