Control 9.3.1General
Top management must review the organisation’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.
Three words, each meaning something different. Suitability is whether the system still fits the organisation — the question 4.1’s context changes force. Adequacy is whether it covers what it needs to cover. Effectiveness is whether it works.
“At planned intervals” does not mean annually; it means at intervals the organisation has decided and can justify. An annual review of a system in a fast-changing organisation is a decision, and one an auditor may reasonably test.
The clause is addressed to top management, not to a security steering group acting on its behalf. Where the review is conducted by people without authority to change resources, scope or priorities, it can record findings and cannot act on them — and the outputs in 9.3.3 then read as observations rather than decisions.
How to put this in place
Top management must look at the ISMS at planned intervals and decide what to change. A review by the security team alone does not count.
- Set the interval, usually at least yearly, and the attendees.
- Prepare a standing agenda and a pre-read.
- Hold the first review after the first internal audit, so the audit results are an input; the CISO Times implementation pack's plan puts it before Stage 1 and its own rule allows until Stage 2, so ask your certification body.
- Record minutes with decisions and actions.
- Follow the actions to closure.
Evidence an auditor usually looks for: a schedule of reviews, agendas, attendance by top management and minutes.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
ISO 27001 Implementation Methodology & Project PlanWord
Covered in Phase 5 (Check) of the implementation plan, which sets out the work and the gate that closes the phase.
Management Review Meeting PackWord
Covers when the review meets, who attends and how to keep it a decision meeting.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed in the table of what an auditor is likely to ask for and sample, by clause, with the likely challenge.