An ISO 27001 management review is a meeting where top management confirms the ISMS is still suitable, adequate and effective. You need at least one top management member present, a prepared set of inputs, decisions recorded as outputs, and minutes. The minutes are the mandatory record.
What the clause is for
Clause 9.3 asks management to review the ISMS at regular intervals. The aim is to confirm it still supports the information security objectives. The standard does not fix a frequency. It says regularly, and auditors check that reviews really happened on the schedule you set.
Who should attend
Define participants up front. Auditors check that at least one member of top management took part. A review run entirely by the security team, with the founder reading the minutes later, tends to draw a finding.
A workable agenda
Clause 9.3.2 lists inputs, and the exact text should be checked in your copy of the standard. Commonly cited inputs are:
- Status of actions from earlier reviews
- Changes in internal and external issues and in interested party needs
- Feedback on security performance, including audit results and nonconformities
A simple agenda built from those might run as follows:
- Actions from the last review, done or not.
- What changed: customers, regulations, systems, suppliers.
- Performance against the objectives set under clause 6.2.
- Internal and external audit results.
- Open nonconformities and corrective actions.
- Risks and opportunities for improvement.
- Decisions.
Outputs that matter
The review should produce decisions on continual improvement and on any change the ISMS needs. This is where meetings go wrong. A set of slides with no decisions looks like attendance, not management. Write each decision with an owner and a date, for example approve a new tool, change the audit schedule or accept a risk.
Minutes
Management review minutes are a mandatory record. A management review procedure is optional. Keep the minutes short and factual: date, attendees, inputs presented, decisions, and actions with owners. Store them where the auditor can reach them.
Preparing without a big document
- Define who attends.
- Pick the date.
- Prepare the input material in advance.
- Draft the decisions you need from the room.
- Record the results in minutes straight after.
A tip for small teams
If your leadership group is two or three people, keep the review to an hour and send the inputs the day before. Put the decisions list at the top of the minutes so a reader sees the outcome first. Keep the minutes from each review in one folder, newest on top, so an auditor can see the pattern across the year.
Quick check
How often should we hold a management review?
The standard says at planned intervals without a number. Many teams hold one at least once a year and before the certification audit, but pick a frequency you will actually keep and write it down.
Can the review be part of a normal leadership meeting?
Yes, as long as the inputs are covered, decisions are recorded, and the minutes show it was a management review of the ISMS.
Sources
- ISO 27001 Clause 9.3 Management review
- ISO 27001 Clause 9 Performance evaluation
- List of mandatory documents required by ISO 27001
Last reviewed: 19 October 2026.
