The management review: what goes in it and who takes part?

One of the clause-9 requirements of ISO 27001. Annual, with senior management, 2 hours. Here is the agenda that an auditor will accept — and that works as a practical exercise for you.

The management review is not a ceremony — it is the one mandatory moment each year at which senior management explicitly commits to the ISMS. 2 hours, once a year.

Who is involved?

• Senior management (ultimately responsible for the ISMS)
• CISO / security lead (which may also be the director themselves in an SMB)
• Data protection officer (where relevant for GDPR)
• Compliance officer (where applicable)

Agenda (fixed)

1. Review of the previous management review — what was decided, what was acted upon?
2. Changes in external context (legislation, customer requirements, threat landscape).
3. Changes in internal context (reorganisation, new systems, growth).
4. Risk management — status of the risk register, top-5 residual risks.
5. Results of internal audits and external audits (stage audits, surveillance).
6. Incident overview — number, categories, lessons learned.
7. Status of controls and access reviews.
8. Objective assessment — have security goals been met?
9. Resources — is the ISMS adequately staffed and funded?
10. Improvement initiatives for the coming year.
11. Action and decision log.

Evidence

Minutes with clear decisions, names, dates, and actions. Signed or digitally confirmed by senior management. This is the key artefact every auditor will ask to see.

See also: PDCA cycle, pre-audit checklist.