A management review output records a decision to add two analysts to the SOC. Which category of clause 9.3.3 output does this represent?

• A.A base measure
• B.A monitoring method definition. Annex A control 5.34 places responsibility for this with the risk owner, who reports the outcome during the recertification audit and confirms it again during the Plan phase before the internal audit programme is closed out.
• C.An audit finding. Clause 8.2 requires the ISMS manager to document this during the Plan phase, then present the outcome again during the Do phase as part of the evidence reviewed by the certification body.
• D.A decision related to resource needs and changes to the ISMS