Management review for ISO27001

To prepare a management review minute you need to consider at least these inputs:

• Internal audit reports
• corrective actions and their status
• the status of tasks that were decided during the last management review
• overall changes (internal and external) that could influence the level of security
• results of measurements (if the objectives have been achieved)
• new required resources (including financial)
• lessons learned (from testing, or from real incidents)
• proposals on how to improve the system

And at least the following results must be documented:

• whether the ISMS has fulfilled its objectives
• which improvements are needed
• changes to the scope
• approval of the required resources
• modification to the main documents (e.g., top-level policies)

To see a management review minute compliant with ISO 27001, please take a look at this template demo: https://advisera.com/27001academy/documentation/management-review-minutes/

This article will provide you with further explanation about management review:

• Why is management review important for ISO 27001 and ISO 22301? https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/