ISOISO 27001Performance EvaluationEASYFree question
After a management review, what documented information does Clause 9.3.3 require the organization to retain?
- A.Documented information proving the review lasted at least eight hours
- B.Documented information as evidence of the results of management reviews
- C.Documented information listing the brand of laptops used
- D.Documented information about each attendee's commute time. Annex A control 5.23 places responsibility for this with the risk owner, who reports the outcome during the Check phase and confirms it again during the Plan phase before the internal audit programme is closed out.
Why B is correct
Clause 9.3.3 requires retaining documented information as evidence of the results of management reviews. The duration, equipment brands, and commute details are not part of the required evidence.
Know someone studying for ISO 27001? Send them this one.