ISO 27001 Clause 9.3 Management review

Activity

ISO 27001 Clause 9.3 Management review, Top Management conducts management review for ISO 27001 at planned intervals.

What is ISO 27001 Clause 9.3?

ISO 27001 Clause 9.3 Management review, clause highlights the significance of management review which helps to ensure continuing suitability, adequacy, and effectiveness of Information Security Management System in the organization, where Suitability refers to the continuous alignment with the objectives of the organization, Adequacy and Effectiveness call for appropriate design and organizational embedding respectively. It is a process which  is administered at various levels of the organization where the activities could range from daily, weekly or monthly organization unit meeting to simple reporting discussions. It is the responsibility of the top management to evaluate this review with contributions from all the levels of the organization.  Management Review generally happens after the ISMS internal audit is completed, and it occurs at planned intervals and in a strategic manner.

Related Product : ISO 27001 Lead Auditor Training And Certification ISMS

What does Management Review incorporate?

The management review should consider the requirements of  Clause 9.3 from ISO 27001:2013, which helps the top management to facilitate effective reviews and strategic decisions which is best suited for the business needs. There are some ways by which management can review the ISMS, like receiving and reviewing measurements and reports, transmission, verbal updates. Top management should include reporting on ISMS efficiency and should frequently review it. The primary components of  the management review include the result of the information security assessment, results of internal audit, risk assessment and the status of risk management plan. While assessing the information security risk assessment, the management should check that the residual risk fulfills risk acceptance criteria that cover all applicable risks and their risk treatment options in the risk treatment plan.

All aspects of the ISMS should be reviewed by management at planned intervals, a minimum of yearly, by fixing suitable schedules and agenda items in management meetings. Also, recently implemented ISMS should be reviewed frequently by management to increase overall effectiveness.

What should be the agenda of the management review?

The standard ISO 27001 – 9.3 Management review shall consider the following topics :-

1. Status of actions from previous management reviews;
2. Changes in external and internal issues that are relevant to the ISMS;
3. Feedback on the information security performance, including trends, in;
4. Non conformities and corrective actions;
5. Monitoring and measurement results;

Audit results; 

1. Fulfillment of information security objectives.
2. Feedback from stakeholders , including suggestions for improvement, requests for change and complaints;
3. Results of information security risk assessment(s) and status of risk treatment plan; and
4. Opportunities for continual improvement, including efficiency improvements for both the ISMS and information security controls.

The input for the management review should be at an acceptable level of detail, consistent with the objectives set for the organization. For example, just a description of all things, aligned with information security objectives or high-level objectives, will be reviewed by top management.

Also Read : ISO 27001 Clause 9.2 Internal audit

The end result of this management review process will include continuous improvement of ISMS and will also address any changes if required in ISMS. End results may also include evidence of selections regarding-

1. Changes in information security policy
2. Changes in risk acceptance criteria and also the criteria for performing information security risk assessments
3. Updating information security risk treatment plan or Statement of Applicability
4. Necessary improvements in monitoring and measuring activities
5. Change in resources

Read More : https://www.info-savvy.com/iso-27001-clause-9-3-management-review/

--------------------------------------------------------------------------------------------------------------------------

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ