Noru

Free template

ISO 27001 management review minutes

An agenda and minutes in one, with a section for each input clause 9.3 lists, so the record shows every input was considered and what top management decided.

Circulate the inputs before the meeting so the time goes on decisions. Hold the review after the internal audit, so its results are an input, and before the certification or surveillance audit.

Write something under every heading, even if it is "no change". Auditors check the minutes against the clause 9.3 list, and a missing input reads as one that was not considered.

The guide behind it: ISO 27001 Management Review: Inputs, Outputs and a Working Agenda

[Company] ISMS management review: [date]

Date[YYYY-MM-DD]
Chair[Name, title]
Attendees[Names and roles; top management must be present]
Presented by[ISMS owner]
Period covered[Since the last review on YYYY-MM-DD]

Actions from previous reviews

ActionOwnerDueStatus
[Action][Role][YYYY-MM-DD][Done / Open / Carried forward]

Changes in external and internal issues

[New regulations, customers, products, providers, reorganisations or threats that affect the ISMS, and what they mean for it.]

Changes in interested parties' needs and expectations

[New contractual security requirements, regulator expectations, customer questionnaire themes.]

Performance of the ISMS

Cover each of: nonconformities and corrective actions, monitoring and measurement results, audit results, and progress on objectives.

  • Nonconformities and corrective actions: [number open and closed, trends, overdue items]
  • Monitoring and measurement: [results against each measure]
  • Audit results: [internal audit summary, certification or surveillance findings]
  • Objectives: [progress on each information security objective]

Feedback from interested parties

[Customer security reviews, complaints, supplier issues, staff reports.]

Risk assessment and treatment

[Risks added, changed or closed since the last review; treatments overdue; residual risks presented for acceptance.]

Opportunities for continual improvement

[Proposals from audits, incidents, staff and the ISMS owner.]

Decisions

Write decisions as decisions. Clause 9.3 expects decisions on improvement opportunities and on any need for changes to the ISMS.

  • [Decision on improvement]
  • [Decision on a change to the ISMS, its scope or its resources]

Actions

ActionOwnerDue
[Action][Role][YYYY-MM-DD]

Approval

Minutes approved by [chair] on [YYYY-MM-DD].

All templates

FAQ

Frequently asked questions

Talk to us

How long should a management review take?

Ninety minutes is enough for a small company when the inputs go out beforehand. The length matters less than the record: every clause 9.3 input considered, and decisions with owners and dates.

Can the management review be part of a board meeting?

Yes, if it covers every clause 9.3 input and the minutes record the decisions. A security update to the board without the risk, audit and nonconformity inputs, or without decisions, does not meet the clause on its own.

Trust, settled.

Templates are the start. Noru drafts the policies from your own setup, tracks approvals and acknowledgements, and keeps the evidence.

Book a demoMore templates