Clause 9.3.3 Management review results
Clause 9.3.3 in ISO 27001:2022 (ISO/IEC 27001:2022). All ISO 27001:2022 controls held. Open ISO 27001:2022 on the standards site.
The control as we hold it
Management review results. The outputs of management review must include decisions on opportunities for continual improvement and on any need to change the ISMS, and documented information must be available as evidence of the review results.
Reviewed and closest counterparts in the other frameworks
We hold no cross-framework row for Clause 9.3.3 yet. The reviewed pairs page lists the released pairs and their coverage.
What an auditor commonly asks for
General guidance for this control area (domain: Clause 9), in our words, not a statement of the standard and not binding on an assessor.
- Minutes recording decisions on improvement opportunities and ISMS changes
- An action log from the review with owners and dates
- Evidence that decisions were implemented
- Retained records of review results