ISO 27001 Management Review Template: 10 Clause 9.3.2 Agenda Items, the Evidence Behind Each, and the 2022 Input Old Minutes Miss
An ISO 27001 management review needs ten agenda items, not seven. Clause 9.3.2 lists inputs (a) to (g), but input (d) asks for trends in four separate areas of performance, and minutes that fold those four into one line lose the trail an auditor follows. This template gives you the agenda, the minutes structure and the outputs record. It maps every input to the document that should feed it, and it flags the line that older templates lack: input (c), changes in the needs and expectations of interested parties, which became its own lettered item in the 2022 edition.
If your organisation is also an essential or important entity under NIS2, the same meeting can carry your Article 20 oversight record. It does that only if you change three things about who attends, what the review covers and when it is held. The sections below cover the ISO meeting first, then the NIS2 add-on.
Who Needs This Template and What the Meeting Has to Prove
In plain terms, the management review is the meeting where top management looks at the evidence and decides whether the ISMS still works and what changes. What it has to prove depends on which rulebook applies to you, and the cadence rules differ more than most templates admit.
| Your situation | What the review must evidence | Cadence in the binding text |
|---|---|---|
| ISO 27001:2022 certified or seeking certification | Clauses 9.3.1–9.3.3: inputs considered, decisions taken, results retained as documented information | “At planned intervals” (no number set) |
| NIS2 essential or important entity | Article 20(1): the management body approves the Article 21 risk-management measures and oversees their implementation | None in the Directive; check your national transposition law |
| Entity covered by Implementing Regulation 2024/2690 (DNS, TLD, cloud, data centre, CDN, MSP, MSSP, online marketplaces, search engines, social networks, trust services) | Annex point 1.1.2: management bodies review the security policy and document the result | At least annually, and when significant incidents or significant changes to operations or risks occur |
| Both ISO-certified and in NIS2 scope | All of the above in one record | Whichever rule is stricter |
The takeaway: an ISO-only organisation chooses its own interval, while an entity covered by the Implementing Regulation has an annual floor plus event triggers written into law.
Get the NIS2 Article 21 Compliance Checklist
90+ assessment items mapped to CIR 2024/2690 — instant PDF, no payment.
The work splits by role. The ISMS lead or CISO assembles the input pack and drafts the minutes. Top management chairs, decides and signs. A compliance officer checks the NIS2 rows against national law. For an SME owner, these roles often sit with two people: the owner chairs, and whoever runs IT prepares the pack. That works under ISO as long as the owner actually reviews and decides rather than receiving a summary afterwards.
The 10 Agenda Items and the Evidence That Feeds Each
Build the agenda as one numbered item per input, with input (d) split into its four trends, and decide in advance which document feeds each row. A row with no named source document is the row that gets skipped.
| # | Clause 9.3.2 input | Feed it from | What the auditor looks for |
|---|---|---|---|
| 1 | (a) Status of actions from previous management reviews | Outputs record of the last review; corrective-action register (clause 10.2) | Every prior action closed, re-dated with a reason, or escalated |
| 2 | (b) Changes in external and internal issues | Context register under clause 4.1, including the climate change determination | What changed since the last review, not a re-read of the list |
| 3 | (c) Changes in needs and expectations of interested parties | Interested-party register under clause 4.2 | New or changed requirements: a contract clause, a regulation, a customer questionnaire |
| 4 | (d)(1) Nonconformities and corrective actions | Corrective-action register | Trend across the period and recurring root causes, not just a count |
| 5 | (d)(2) Monitoring and measurement results | Clause 9.1 measurement report | Results against the targets you set |
| 6 | (d)(3) Audit results | Internal audit report (clause 9.2) and any external audit report | Findings and their status |
| 7 | (d)(4) Fulfilment of information security objectives | Objectives plan (clause 6.2) | Each objective marked met, not met, or on track, with a reason |
| 8 | (e) Feedback from interested parties | Customer audits and questionnaires, complaints, supplier reports, regulator correspondence | What interested parties said about your security performance |
| 9 | (f) Results of risk assessment and status of the risk treatment plan | Risk register and risk treatment plan | Current results, open treatment actions, residual risk |
| 10 | (g) Opportunities for continual improvement | Any source, including attendees | At least one improvement considered and decided on |
The pattern behind the table: rows 4 to 9 can be filled from reports your ISMS produces anyway. Rows 2 and 3 cannot. No system generates “what changed in our context this year”. Someone has to compare this year’s registers with last year’s, and when nobody owns that comparison, the row is the first to go. Clause 9.3.2(d) also asks for trends, so rows 4 to 7 need at least two periods of data. A single snapshot does not show a trend. If you are preparing for your first review before certification, the baseline from an ISO 27001 gap analysis gives you that first comparison point, and your ISO 27001 internal audit must finish before the review so that row 6 has something to report.
The 2022 Input That Minutes Skip: Changes in Interested-Party Needs
Input (c) is not the same as input (e). Since 2022 it has been its own lettered item in the list the review must consider, and templates that merge the two miss it. In SGS’s comparison of the 2013 and 2022 editions, the certification body shows “changes in needs and expectations of interested parties that are relevant to the information security management system” as text added to 9.3.2. SGS also notes that the new and rearranged text clarifies the requirements and adds no new ones. Even so, a template written for the 2013 layout has no line for it, because that edition did not list it. Since an auditor checks the minutes against the 2022 list, the row has to be there. TCSA’s clause 9.3 guide names interested-party changes and objective fulfilment as the inputs auditors most often find skipped.
The difference is direction. Input (e) is what interested parties told you about your performance, such as a customer’s audit score or a supplier’s incident report. Input (c) is what they now require, which may not have been tested yet. If a customer adds a NIS2 supply-chain security clause to its contract, that belongs in row 3 even if the customer has never audited you. The same customer’s questionnaire result belongs in row 8. That is why the agenda above gives them separate rows, and why row 3 is fed from the interested-party register under clause 4.2, the same requirements you recorded when setting the ISMS scope statement, rather than from feedback channels.
Since 2024 there is a second reason to keep rows 2 and 3 separate and specific. ISO/IEC 27001:2022/Amd 1:2024 is a one-page amendment, published in February 2024 and listed by ISO at no charge. According to the joint ISO-IAF communiqué, it adds a sentence to clause 4.1, “The organization shall determine whether climate change is a relevant issue”, and a note to clause 4.2 that relevant interested parties “can have requirements related to climate change.” The communiqué says the overall intent of 4.1 and 4.2 is unchanged. The IAF Technical Committee decision said certification bodies should include the new text in their audits from publication. Where an organisation cannot show that relevant issues, climate change included, have been considered, “a suitable finding should be raised.” Recording the climate determination in row 2, and any climate-related requirement in row 3, costs one sentence each.
Management Review Minutes Template: The Structure to Copy
Good minutes record, for every input, what was presented, what was discussed and what was concluded. They then list each decision with an owner and a date. Clause 9.3.3 requires the results to include decisions on continual improvement opportunities and any needs for changes to the ISMS, and requires documented information to be available as evidence of those results.
| Minutes block | What to record | Example entry |
|---|---|---|
| Header | Date, duration, location, chair, attendees by role, period covered | 14 March, 90 min, chaired by Managing Director; period 1 Mar–28 Feb |
| Input rows 1–10 | For each row: summary presented / discussion / conclusion | Row 3: “Two customers added supplier-security clauses; one new sector regulation. Conclusion: update 4.2 register, assess in risk review.” |
| Rows with nothing new | Keep the row and write “no change since last review” with the source checked | Row 2: “No change; context register v4 reviewed, climate determination unchanged (not relevant).” |
| Outputs record (9.3.3) | Decision, type (continual improvement or ISMS change), owner, resources, due date | “Add supplier tiering to A.5.19 procedure; ISMS change; IT Lead; 3 days; 30 June” |
| Overall conclusion | Chair’s statement on whether the ISMS remains suitable, adequate and effective, with signature | “Suitable and adequate; effectiveness actions decided above.” |
The single rule that prevents most findings is never to delete a row. An empty input row reads as an input that was never considered. A row that says “no change” and names the document checked shows the input was considered and nothing had moved. Vanta’s management review checklist gives similar advice: record attendees, date and duration, note each agenda input and its conclusion, and for every action state what will be done, who is responsible and the target deadline. Keep the slides or input pack with the minutes. The “trends” in rows 4 to 7 live there, and an auditor who doubts a conclusion will ask to see the data behind it. For choosing the numbers that go into row 5, see our list of security metrics auditors expect.
How Often to Hold It and Who Has to Be in the Room
ISO 27001 fixes no frequency. High Table’s clause 9.3 guide quotes clause 9.3.1: top management shall review the ISMS “at planned intervals to ensure its continuing suitability, adequacy and effectiveness”. Practitioner advice ranges widely. High Table recommends monthly reviews with three-monthly as its minimum, while TCSA treats an annual full review as the practical minimum, with optional shorter quarterly check-ins. Both are opinions, not requirements. As a general guideline, hold one full review a year, and add one before your certification audit if the timing does not line up.
The law can set a floor that ISO does not. For entities in the scope of Commission Implementing Regulation (EU) 2024/2690, Annex point 1.1.2 requires management bodies to review the security policy “at least annually and when significant incidents or significant changes to operations or risks occur”, and to document the result. Point 2.1.4 sets the same annual floor for reviewing the risk assessment results and risk treatment plan, which is the evidence behind row 9. So if you are in the Regulation’s scope, plan one review a year and write an extraordinary-review trigger into your procedure.
On attendance, clause 9.3.1 assigns the review to top management, so an ISMS lead presenting to colleagues at the same level does not satisfy it. There is a scope subtlety here. The standard ISO definition of top management, quoted from ISO 22300 in Estonia’s cybersecurity terminology database, adds: “If the scope of the management system covers only part of an organization, then top management refers to those who direct and control that part of the organization.” A CIO who runs a scoped ISMS covering one business unit can therefore be top management for ISO purposes. That is valid for ISO 27001, and it is exactly where NIS2 diverges.
Using One Meeting as NIS2 Article 20 Oversight Evidence
A management review can evidence NIS2 oversight, but it does not do so by default. Article 20(1) of the NIS2 Directive requires Member States to ensure that “the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements”. The Directive uses “management bodies” only in Recital 137 and Article 20 and does not define the term, so who counts is settled by national law. A scope-bound ISO review differs from what Article 20 asks for in three ways:
- Who: ISO’s top management can be the head of the scoped unit. Article 20 addresses the entity’s management body, typically the board or the managing directors, depending on national company law. Have at least one member of the management body chair the review, or put the minutes to the management body for formal approval.
- What: the ISMS covers what sits inside its scope and Statement of Applicability. Article 20 covers all the measures the entity takes to comply with Article 21. Add a row for Article 21 measures outside the ISMS scope.
- When: ISO allows any planned interval. For entities in the Implementing Regulation’s scope, Annex points 1.1.2 and 1.2.6 add significant incidents and significant changes as review triggers.
Add these rows to the minutes after row 10:
| NIS2 row | Legal basis | Minute entry | Effort |
|---|---|---|---|
| N1 Approval of measures | NIS2 Art. 20(1) | Management body approves the Article 21 measures as listed in a named, versioned register | Low |
| N2 Oversight conclusion | NIS2 Art. 20(1) | Implementation status of those measures, gaps, and decisions taken | Medium |
| N2a Measures outside the ISMS scope | NIS2 Art. 20(1) with Art. 21 | Article 21 measures not covered by the ISMS scope or Statement of Applicability, with their implementation status | Medium |
| N3 Security policy review | CIR 2024/2690 Annex 1.1.2 (relevant entities) | Policy reviewed; updated or confirmed; result documented | Low |
| N4 Residual risk acceptance | CIR 2024/2690 Annex 2.1.1 (relevant entities) | Risk assessment results and residual risks accepted by management bodies or accountable persons | Medium |
| N5 Management training | NIS2 Art. 20(2) | Training status of management body members (our suggestion for where to record it, not a legal requirement) | Low |
For board members, the reason to sign these rows is personal. Under Article 20(1), Member States must ensure that management bodies can be held liable for infringements of Article 21, and national laws may add further rules on top. A minuted approval and oversight conclusion is the record that shows the body did its part. Our guide to Article 20 management liability covers how that liability works.
Six Ways Management Review Minutes Fail an Audit
Each failure below is a failure of the record. The discussion may well have happened, but the minutes do not show it.
| What the auditor sees | Why it fails | Fix |
|---|---|---|
| An input missing from the minutes | 9.3.2 says the review “shall include consideration of” every input | Fixed rows; “no change” instead of deletion |
| Discussion recorded, no decisions | 9.3.3 requires decisions on improvement and ISMS changes | Outputs record with owner and date for each decision |
| Last review’s actions not mentioned | Input (a) is the status of previous actions | Row 1 lists every prior action by number |
| No completed review before Stage 2 | TCSA describes a missing review before the certification audit as “major-nonconformity territory” | Schedule the first review after the internal audit and before Stage 2 |
| ISMS lead attended, top management did not | 9.3.1 assigns the review to top management | Chair from top management; name them in the header |
| No climate change determination | Amd 1:2024 added it to 4.1; IAF says a suitable finding should be raised where relevant issues, climate change included, were not considered | One sentence in row 2, even if the answer is “not relevant” |
The fixes for failures 1, 2, 3 and 6 cost nothing but a fixed template. That is the case for standardising the minutes format before the first review rather than after the first finding. For where the management review sits in the full certification sequence, see the ISO 27001 compliance guide.
Frequently Asked Questions
Is the management review mandatory in ISO 27001?
Yes. Clause 9.3.1 requires top management to review the ISMS at planned intervals, and clause 9.3.3 requires documented information to be available as evidence of the results. In practice, the minutes and outputs record are that evidence.
How often should an ISO 27001 management review be held?
ISO 27001 says “at planned intervals” and sets no number. Practitioner advice ranges from monthly to annual, and one full review a year is a sensible baseline. Entities in the scope of Implementing Regulation 2024/2690 must have management bodies review the security policy at least annually and when significant incidents or significant changes to operations or risks occur.
Can the ISMS manager run the management review alone?
No. Clause 9.3.1 assigns the review to top management. The ISMS manager prepares the inputs and drafts the minutes, but top management must review and decide.
Does an ISO 27001 management review satisfy NIS2 Article 20?
Not automatically. It can serve as evidence of Article 20 oversight if a member of the management body chairs it or the management body formally approves the minutes, if the review covers all Article 21 measures, including any outside the ISMS scope, and if the approval and oversight conclusions are minuted. Entities in the Implementing Regulation’s scope must also have management bodies review the security policy (Annex point 1.1.2) and roles and responsibilities (point 1.2.6) when significant incidents or significant changes occur, and the management review is a natural place to minute both.
What changed in clause 9.3 in the 2022 edition?
The clause was split into 9.3.1, 9.3.2 and 9.3.3, and input (c), changes in the needs and expectations of interested parties, was added. SGS describes these changes as clarifications that add no new requirements. Separately, Amendment 1:2024 added the climate change determination to clause 4.1, which feeds input (b).
This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.
Sources
- Directive (EU) 2022/2555 (NIS2 Directive), Official Journal of the European Union — EUR-Lex. Recital 137 and Article 20 (linked above).
- Commission Implementing Regulation (EU) 2024/2690, Official Journal of the European Union — EUR-Lex. Article 1; Annex points 1.1.2, 1.2.6, 2.1.1 and 2.1.4 (linked above).
- SGS. Comparing ISO/IEC 27001:2022 to ISO/IEC 27001:2013 — What are the changes? Guidance document (linked above).
- ISO. ISO/IEC 27001:2022/Amd 1:2024 — Climate action changes, catalogue record (linked above).
- ISO and IAF. IAF/ISO Joint Communiqué on the addition of Climate Change considerations to Management Systems Standards, 22 February 2024 (linked above).
- IAF. IAF-ISO Joint Communiqué and IAF Technical Committee Final Decision on climate change notes, February 2024 (linked above).
- AKIT, Estonian cybersecurity terminology database (akit.cyber.ee). “Top management”, definition and notes from ISO 22300 (linked above).
- TCSA. ISO 27001 Clause 9.3 Management Review (linked above).
- Vanta. ISO/IEC 27001:2022 ISMS Management Review Checklist (linked above).
- High Table. ISO 27001 Clause 9.3 Management Reviews Essential Guide (linked above).
Get the NIS2 Article 21 Compliance Checklist
90+ assessment items mapped to CIR 2024/2690 — instant PDF, no payment.
