ISOISO 27001Performance EvaluationEASYFree question
Which set of items are explicitly required outputs of the management review under clause 9.3.3?
- A.Approval of the audit programme for the next cycle and the appointment of the lead internal auditor
- B.Decisions related to continual improvement opportunities and any need for changes to the ISMS
- C.Findings raised by the certification body during the surveillance visit and the corrective action plan owners
- D.Updated monitoring results from the control owners and the schedule of internal audits for the next year
Why B is correct
Clause 9.3.3 states the outputs of the management review shall include decisions related to continual improvement opportunities and any need for changes to the information security management system. These are decision-oriented outcomes, not administrative artefacts.
Know someone studying for ISO 27001? Send them this one.