--- title: "ISO 27001 Management Reviews: Both Misunderstood & Underappreciated" description: The management review is about so much more than compliance, use this practice to build a relationship with your decision makers and strengthen your ISMS. image: https://blog.intertecintl.com/hubfs/2020%20Redesign/business_analysis_it_service.jpg --- [![Logo_web](https://blog.intertecintl.com/hs-fs/hubfs/Logo_web.png?width=1920&height=1080&name=Logo_web.png "Logo_web")](http://Intertec%20International) - [Why Nearshore?](https://www.intertecintl.com/why-nearshore) - [About Intertec](https://www.intertecintl.com/about) - [Blog](https://blog.intertecintl.com) - [Employment Verification](https://info.intertecintl.com/request-employee-information-from-human-resources) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/7230565/ee4af9bf-0c3c-411c-a65a-bf21cf958902.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/7230565/ee4af9bf-0c3c-411c-a65a-bf21cf958902) [![Intertec International](https://blog.intertecintl.com/hs-fs/hubfs/Logo_web.png?width=1920&height=1080&name=Logo_web.png "Intertec International")](http://Intertec%20International) - [Why Nearshore?](https://www.intertecintl.com/why-nearshore) - [About Intertec](https://www.intertecintl.com/about) - [Blog](https://blog.intertecintl.com) - [Employment Verification](https://info.intertecintl.com/request-employee-information-from-human-resources) [![Schedule A Meeting](https://no-cache.hubspot.com/cta/default/7230565/bb88404d-87cd-4a9d-9ec6-63d42304ee0b.png)](https://cta-redirect.hubspot.com/cta/redirect/7230565/bb88404d-87cd-4a9d-9ec6-63d42304ee0b) # INTERTEC BLOG ## **Our Latest Content is on the FPT Blog** Feel free to browse our existing content below, however, if you're looking for the latest articles, we now post them to [FPT Software's blog page](https://blog.fpt-software.com/).  ## [ISO 27001 Management Reviews: Both Misunderstood & Underappreciated](https://blog.intertecintl.com/your-iso-27001-management-review-is-both-misunderstood-and-underappreciated) May 20, 2021 / by [Frederid Palacios](https://blog.intertecintl.com/author/frederid-palacios) - [Tweet](https://twitter.com/share) Earning your ISO 27001 certification is a time-consuming and robust process. To earn your certificate, you must undergo lengthy [documentation](https://blog.intertecintl.com/mandatory-documents-you-cant-forget-for-your-iso-certification), auditing, and more - all of which are vital to the process. Some of these procedures are optional, meant only to help you specify your ISMS and prepare you for later steps. But, the majority are mandatory components of the certification that must be completed carefully and accurately. One mandatory, yet often overlooked practice is the [management review](https://advisera.com/27001academy/blog/2014/03/03/why-is-management-review-important-for-iso-27001-and-iso-22301/), detailed in clause 9.3 of the ISO 27001 list of standards. While this review is mandatory, it is one of the most misunderstood and underappreciated elements of these standards. We will discuss what the management review entails, and why it is important so that you may better understand and appreciate the process. ![business_analysis_it_service](https://blog.intertecintl.com/hs-fs/hubfs/2020%20Redesign/business_analysis_it_service.jpg?width=900&name=business_analysis_it_service.jpg)  ## **Clause 9.3** [ISO 27001 clause 9.3](https://www.isms.online/iso-27001/9-3-management-review/) explains that it is the responsibility of senior management to conduct the management review. These reviews should be pre-planned and be often enough that it verifies the continued effectiveness of an organization’s ISMS, ensuring that it achieves the aims of the business. ISO states that this review should be conducted at planned interviews, which tends to be once per year and within an external audit surveillance period. While this is the minimum requirement, it is recommended that you perform it more often. A more frequent management review will allow for your ISMS to keep up with the ever-changing pace of information security threats. The review should be viewed as a continuous practice to maintain and monitor your ISMS. While often underestimated, the management review should not be perceived as merely checking off a box for ISO compliance. For organizations looking to live and breathe information security practice, the role of the management review is invaluable.   ## **Purpose** Before you can come to better understand and appreciate the importance of the management review, you must learn its purpose. While the review is primarily only conducted to satisfy the certification auditor, it can also serve as an excellent opportunity for top management to actively participate in information security. The purpose of clause 9.3, which outlines the management review, is to ask your executives to make crucial decisions that will significantly impact your [ISMS](https://blog.intertecintl.com/benefits-of-an-iso-compliant-isms). This may not sound too complex, but it must be performed in a systematic manner. Overall, your management review should ensure that the ISMS and its objectives continue to remain adequate and effectives given your company’s purpose, issues, and risks around your information assets. The work leading up to and around the management review will enable senior management to make informed and strategic decisions surrounding your ISMS and how it is managed. [![Cyber Security as a Competitive Advantage](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/7230565/3dbc25c1-2506-4ef1-89e7-b28f06cd6591.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/7230565/3dbc25c1-2506-4ef1-89e7-b28f06cd6591)   ## **What is Included?** The first order of business is to revisit any ongoing actions that were decided upon in previous management reviews. If you requested any statistical analysis or decided to adjust a process now is the time to check them and get further review. Next, you should discuss any internal or external issues relevant to the ISMS. This may include information assets, people, products, and systems, in addition to political problems, new technologies, and economic fluctuations. Following this, you will move on to the overall performance of your ISMS and ISO 27001 requirements. At minimum, the management review will follow the standard ISO 27001 format laid out in clause 9.3, but it can be beneficial for your organization to include more. The formal review agenda at minimum should include; - The status of actions from previous reviews - Changes in internal and external issues relevant to the ISMS - Feedback on information security performance including nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfillment of information security objectives - Feedback from interested parties - Results of the [risk assessment](https://blog.intertecintl.com/developing-a-risk-assessment-methodology-for-your-iso-certification) and status of [risk treatment](https://blog.intertecintl.com/deciding-on-your-iso-27001-certification-risk-treatment)plan - Opportunities for continual improvement Including other compliance regimes and best practices can be resourceful in facilitating effective reviews and informed decision making. You can tie the 9.3 information security aspects into broaden senior management meetings or formal board meetings to further its reach and effectiveness. Including the agreement on audit focus for a coming period is also a great addition. While this is optional, external auditors want as much clarity as possible into your organization and this can provide that. Regardless of what you include, it must document the results and actions from the reviews. For organizations in the implementation phase of their ISMS, it is recommended to conduct weekly management reviews as part of habit building. This should include implementation lessons, next period goals, and identifying issues alongside the formal management agenda. If you are preparing for your external audit, these are excellent practices for impressing your auditor and demonstrating how devoted your company is to information security. The outputs of the management review should include any corrective actions and continual improvement opportunities to ensure the utmost effectiveness of your security processes. Practicing effective management from the start is key to the maintenance of a success and robust ISMS.    ## **Maximizing your Management Review** As the name suggests, senior management will play a significant role in the management review. This may take the form of an ISMS board, generally including the CISO, department heads, and other executives. To ensure that you are maximizing the effectiveness of your review, we will go through some best practices. It is important to keep attendees to a minimum. While it is important that the entire organization be involved and aware of your ISMS practices, too many opinions can complicate the process. For this reason, it’s best to keep only a small group involved with the review. It is also beneficial to keep management reviews and management meetings separate. It is likely that senior management already meet on a regular basis to address day-to-day operations, so it is best to keep the two separate to avoid conflict or overlooked information security concerns. You should be sure to keep minutes during your review. Not only is it required by ISO 27001 to document the content and results of your reviews, but it also helps to remind you of topics that came up and the corresponding decisions made. Finally, provide a summary of your management review. This is helpful for attendees to have a brief overview of what was discussed. ## **What is the Misunderstanding?** Now that you are an expert in the ISO 27001 management review it’s hard to understand how it could ever be overlooked. The review process is instrumental in strengthening your information security from the top down. While it can be easy to simply view the review as ticking off a box, there is so much value in a thorough and virtuous review. Not only will this simplify your [ISO 27001 implementation](https://blog.intertecintl.com/key-benefits-of-iso-27001-implementation) process and help you pass your audit with flying colors, but it will ensure the continual improvement and success of your ISMS. The management review is about so much more than compliance, use this practice to build a relationship with your decision makers and strengthen your ISMS. [![contact us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/7230565/99945ac5-0911-40bf-95ca-d96080542cf0.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/7230565/99945ac5-0911-40bf-95ca-d96080542cf0) Tags: [Cyber Security](https://blog.intertecintl.com/topic/cyber-security) ![Frederid Palacios](https://blog.intertecintl.com/hubfs/Images/fred_headshot.jpeg) #### Written by [Frederid Palacios](https://blog.intertecintl.com/author/frederid-palacios) Fred Palacios is a seasoned software architect with more than 20 years of experience participating in the entire software development cycle across a host of different industries--from automotive and services to petroleum, financial, and supply chain. In that time, his experience working closely with high-level stakeholders has provided him with a strategic vision for developing the right solutions to flexibly meet critical business needs. As CTO of Intertec, he's continuing to focus on the creation of business-critical applications for large enterprise projects, particularly those that handle high concurrency and large datasets. He is passionate about using technology as a tool to solve real-world problems and also mentoring technical teams to achieve their maximum potential and deliver quality software. ## Leave A Comment ### Subscribe to Email Updates - [Recent](https://blog.intertecintl.com/your-iso-27001-management-review-is-both-misunderstood-and-underappreciated#tab-1) - [Popular](https://blog.intertecintl.com/your-iso-27001-management-review-is-both-misunderstood-and-underappreciated#tab-2) - [Categories](https://blog.intertecintl.com/your-iso-27001-management-review-is-both-misunderstood-and-underappreciated#tab-3) ### Lists by Topic - [Cyber Security (56)](https://blog.intertecintl.com/tag/cyber-security) - [Technical Support Services (50)](https://blog.intertecintl.com/tag/technical-support-services) - [Cloud Migration (45)](https://blog.intertecintl.com/tag/cloud-migration) - [Project Management (31)](https://blog.intertecintl.com/tag/project-management) - [Software Development (26)](https://blog.intertecintl.com/tag/software-development) - [Infrastructure (16)](https://blog.intertecintl.com/tag/infrastructure) - [Remote Work (15)](https://blog.intertecintl.com/tag/remote-work) - [Recruitment (11)](https://blog.intertecintl.com/tag/recruitment) - [Near-Shoring (9)](https://blog.intertecintl.com/tag/near-shoring) - [Quality Assurance (9)](https://blog.intertecintl.com/tag/quality-assurance) - [Agile (8)](https://blog.intertecintl.com/tag/agile) - [MDM (8)](https://blog.intertecintl.com/tag/mdm) - [DevOps (7)](https://blog.intertecintl.com/tag/devops) - [GRC (7)](https://blog.intertecintl.com/tag/grc) - [Governance, Risk, and Compliance (7)](https://blog.intertecintl.com/tag/governance-risk-and-compliance) - [DaaS (6)](https://blog.intertecintl.com/tag/daas) - [Product Development (6)](https://blog.intertecintl.com/tag/product-development) - [Test Engineering (5)](https://blog.intertecintl.com/tag/test-engineering) - [KPIs (3)](https://blog.intertecintl.com/tag/kpis) - [SAP Hybris (3)](https://blog.intertecintl.com/tag/sap-hybris) - [Cloud Security (2)](https://blog.intertecintl.com/tag/cloud-security) - [20th Anniversary (1)](https://blog.intertecintl.com/tag/20th-anniversary) - [E-commerce (1)](https://blog.intertecintl.com/tag/e-commerce) see all ### Posts by Topic - [Cyber Security (56)](https://blog.intertecintl.com/tag/cyber-security) - [Technical Support Services (50)](https://blog.intertecintl.com/tag/technical-support-services) - [Cloud Migration (45)](https://blog.intertecintl.com/tag/cloud-migration) - [Project Management (31)](https://blog.intertecintl.com/tag/project-management) - [Software Development (26)](https://blog.intertecintl.com/tag/software-development) - [Infrastructure (16)](https://blog.intertecintl.com/tag/infrastructure) - [Remote Work (15)](https://blog.intertecintl.com/tag/remote-work) - [Recruitment (11)](https://blog.intertecintl.com/tag/recruitment) - [Near-Shoring (9)](https://blog.intertecintl.com/tag/near-shoring) - [Quality Assurance (9)](https://blog.intertecintl.com/tag/quality-assurance) - [Agile (8)](https://blog.intertecintl.com/tag/agile) - [MDM (8)](https://blog.intertecintl.com/tag/mdm) - [DevOps (7)](https://blog.intertecintl.com/tag/devops) - [GRC (7)](https://blog.intertecintl.com/tag/grc) - [Governance, Risk, and Compliance (7)](https://blog.intertecintl.com/tag/governance-risk-and-compliance) - [DaaS (6)](https://blog.intertecintl.com/tag/daas) - [Product Development (6)](https://blog.intertecintl.com/tag/product-development) - [Test Engineering (5)](https://blog.intertecintl.com/tag/test-engineering) - [KPIs (3)](https://blog.intertecintl.com/tag/kpis) - [SAP Hybris (3)](https://blog.intertecintl.com/tag/sap-hybris) - [Cloud Security (2)](https://blog.intertecintl.com/tag/cloud-security) - [20th Anniversary (1)](https://blog.intertecintl.com/tag/20th-anniversary) - [E-commerce (1)](https://blog.intertecintl.com/tag/e-commerce) See all ### Recent Posts --- ### Find What You're Looking For ### Filter by Topic - [Cyber Security (56)](https://blog.intertecintl.com/tag/cyber-security) - [Technical Support Services (50)](https://blog.intertecintl.com/tag/technical-support-services) - [Cloud Migration (45)](https://blog.intertecintl.com/tag/cloud-migration) - [Project Management (31)](https://blog.intertecintl.com/tag/project-management) - [Software Development (26)](https://blog.intertecintl.com/tag/software-development) - [Infrastructure (16)](https://blog.intertecintl.com/tag/infrastructure) - [Remote Work (15)](https://blog.intertecintl.com/tag/remote-work) - [Recruitment (11)](https://blog.intertecintl.com/tag/recruitment) - [Near-Shoring (9)](https://blog.intertecintl.com/tag/near-shoring) - [Quality Assurance (9)](https://blog.intertecintl.com/tag/quality-assurance) - [Agile (8)](https://blog.intertecintl.com/tag/agile) - [MDM (8)](https://blog.intertecintl.com/tag/mdm) - [DevOps (7)](https://blog.intertecintl.com/tag/devops) - [GRC (7)](https://blog.intertecintl.com/tag/grc) - [Governance, Risk, and Compliance (7)](https://blog.intertecintl.com/tag/governance-risk-and-compliance) - [DaaS (6)](https://blog.intertecintl.com/tag/daas) - [Product Development (6)](https://blog.intertecintl.com/tag/product-development) - [Test Engineering (5)](https://blog.intertecintl.com/tag/test-engineering) - [KPIs (3)](https://blog.intertecintl.com/tag/kpis) - [SAP Hybris (3)](https://blog.intertecintl.com/tag/sap-hybris) - [Cloud Security (2)](https://blog.intertecintl.com/tag/cloud-security) - [20th Anniversary (1)](https://blog.intertecintl.com/tag/20th-anniversary) - [E-commerce (1)](https://blog.intertecintl.com/tag/e-commerce) This is a search field with an auto-suggest feature attached. - There are no suggestions because the search field is empty. ### Filter Date - [March 2023 (6)](https://blog.intertecintl.com/archive/2023/03) - [February 2023 (11)](https://blog.intertecintl.com/archive/2023/02) - [January 2023 (5)](https://blog.intertecintl.com/archive/2023/01) - [December 2022 (3)](https://blog.intertecintl.com/archive/2022/12) - [November 2022 (1)](https://blog.intertecintl.com/archive/2022/11) - [September 2022 (2)](https://blog.intertecintl.com/archive/2022/09) - [August 2022 (5)](https://blog.intertecintl.com/archive/2022/08) - [June 2022 (5)](https://blog.intertecintl.com/archive/2022/06) - [May 2022 (12)](https://blog.intertecintl.com/archive/2022/05) - [April 2022 (2)](https://blog.intertecintl.com/archive/2022/04) - [March 2022 (2)](https://blog.intertecintl.com/archive/2022/03) - [February 2022 (3)](https://blog.intertecintl.com/archive/2022/02) - [January 2022 (9)](https://blog.intertecintl.com/archive/2022/01) - [December 2021 (6)](https://blog.intertecintl.com/archive/2021/12) - [November 2021 (11)](https://blog.intertecintl.com/archive/2021/11) - [September 2021 (8)](https://blog.intertecintl.com/archive/2021/09) - [August 2021 (9)](https://blog.intertecintl.com/archive/2021/08) - [July 2021 (7)](https://blog.intertecintl.com/archive/2021/07) - [June 2021 (10)](https://blog.intertecintl.com/archive/2021/06) - [May 2021 (7)](https://blog.intertecintl.com/archive/2021/05) - [April 2021 (9)](https://blog.intertecintl.com/archive/2021/04) - [March 2021 (8)](https://blog.intertecintl.com/archive/2021/03) - [February 2021 (8)](https://blog.intertecintl.com/archive/2021/02) - [January 2021 (8)](https://blog.intertecintl.com/archive/2021/01) - [December 2020 (10)](https://blog.intertecintl.com/archive/2020/12) - [November 2020 (8)](https://blog.intertecintl.com/archive/2020/11) - [October 2020 (5)](https://blog.intertecintl.com/archive/2020/10) - [September 2020 (3)](https://blog.intertecintl.com/archive/2020/09) - [August 2020 (6)](https://blog.intertecintl.com/archive/2020/08) - [July 2020 (8)](https://blog.intertecintl.com/archive/2020/07) - [June 2020 (9)](https://blog.intertecintl.com/archive/2020/06) - [May 2020 (8)](https://blog.intertecintl.com/archive/2020/05) - [April 2020 (9)](https://blog.intertecintl.com/archive/2020/04) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/7230565/504e5f3a-2b20-4d06-91fd-df5c2b06c682.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/7230565/504e5f3a-2b20-4d06-91fd-df5c2b06c682) ## Subscribe to Our Blog Get the latest on industry news and Intertec updates! ### Subscribe Here! [![Logo_Full name_white](https://blog.intertecintl.com/hs-fs/hubfs/Logo_Full%20name_white.png?width=1920&height=1080&name=Logo_Full%20name_white.png "Logo_Full name_white")](http://Intertec%20International) ![SAP Silver Partner](https://blog.intertecintl.com/hubfs/Footer/sap-partner.png "SAP Silver Partner") ![Microsoft Partner](https://blog.intertecintl.com/hubfs/Footer/logo-micro-footer.png "Microsoft Partner") Company [About Us](https://www.intertecintl.com/about) [Why Nearshore?](https://www.intertecintl.com/why-nearshore) [Locations & Contact](https://www.intertecintl.com/contact) [Privacy Policy](https://www.intertecintl.com/privacy-policy) Services & Solutions [IT Services](https://www.intertecintl.com/it-services) [Information Security Management System Policy](https://www.intertecintl.com/information-security-management-system-policy) Resources [Blog](https://blog.intertecintl.com/) [Careers](https://www.intertecintl.com/careers) [Resources](https://info.intertecintl.com/remote-office-worker) Copyright © Intertec International. All Rights Reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Frederid Palacios", "url" : "https://blog.intertecintl.com/author/frederid-palacios" }, "dateModified" : "2021-10-21T18:04:56.007Z", "datePublished" : "2021-05-20T16:00:00.000Z", "headline" : "ISO 27001 Management Reviews: Both Misunderstood & Underappreciated", "image" : [ "https://blog.intertecintl.com/hubfs/2020%20Redesign/business_analysis_it_service.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.intertecintl.com/your-iso-27001-management-review-is-both-misunderstood-and-underappreciated", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.intertecintl.com/hubfs/Logo_web.png" }, "name" : "Intertec International" } } ```