#iso27001/2013
## 9.3 Management review

Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

The management review shall include consideration of:

a) the status of actions from previous management reviews;

b) changes in external and internal issues that are relevant to the information security management system;

c) feedback on the information security performance, including trends in:

1) nonconformities and corrective actions;
2) monitoring and measurement results;
3) audit results; and
4) fulfilment of information security objectives;

d) feedback from interested parties;

e) results of risk assessment and status of risk treatment plan; and

f) opportunities for continual improvement.

The outputs of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.

The organization shall retain documented information as evidence of the results of management reviews.

## 9.3 Management review

  

Top management shall review the organization’s information security management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness.

  

The management review shall include consideration of:

  

a) the status of actions from previous management reviews;

  

b) changes in external and internal issues that are relevant to the information security management system;

  

c) feedback on the information security performance, including trends in:

  

1) nonconformities and corrective actions;

2) monitoring and measurement results;

3) audit results; and

4) fulfilment of information security objectives;

  

d) feedback from interested parties;

  

e) results of risk assessment and status of risk treatment plan; and

  

f) opportunities for continual improvement.

  

The outputs of the management review shall include decisions related to continual improvement opportunities and any needs for changes to the information security management system.

  

The organization shall retain documented information as evidence of the results of management reviews.