July 2026. ISO 27001 requires periodic management review of the ISMS. At surveillance auditors ask: did leadership see risks, incidents and resources — and decide on acceptance, investment and priority?
Required input (minimum)
- status of actions from prior reviews;
- changes in context, scope, risks, requirements;
- internal audit, external audit, CAP results;
- incidents, near-misses, complaints, metrics;
- vendors/chain, awareness, continual improvement.
Output that counts
Minutes with decisions: which risks accepted, which investment approved, which scope change. Generic “we are progressing” without decision is insufficient. Link output to improvement register and budget.
More: ISMS and audit preparation. Add NIS2/GDPR items where relevant — one agenda.
Board presence: CEO or delegated leadership must be visible — CISO-only review is weak evidence for NIS2 and ISO.
KPIs leadership understands
Translate security metrics to business language: outage minutes, open major CAPs, phishing click rate, average patch time, open chain risks at top vendors. Avoid jargon without explanation.
Actions from management review must sit in improvement register with owner — follow-up next review is mandatory input. Auditors sample closed loop.
NIS2 and GDPR items on the same agenda prevent leadership hearing two stories. One minutes set, tags per framework.
Next steps in your ISMS
Turn this article into one concrete action in your risk register or improvement plan: owner, deadline, expected evidence. Discuss progress in the next management review — auditors and chain partners want decisions, not policy intent alone. Link where possible to existing ISO 27001, NIS2 or GDPR documentation so you do not maintain parallel folders.
Questions on scope, certification or chain requirements? Use our readiness overview and knowledge base for deeper guidance. This article does not replace legal or audit advice for your situation.
Share relevant findings briefly with line management and procurement — compliance becomes workable when the whole organisation recognises the same priorities. Repeat the chosen action quarterly in team meetings and update evidence locations in your SoA or control plan so surveillance samples are easy to answer.