Management Review

This is the help text the console shows in the help panel on this page.

ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. This page produces and documents that review, giving you a signed record of leadership engagement.

Creating a Review

Click Generate Annual Review. AutoCISO builds a review for the period from your current ISMS data. Click a review in the list to open it; All Reviews takes you back.

ISMS Metrics

Populated automatically from your ISMS data:

• Open Risks and Accepted/Transferred Risks
• Open NCs (nonconformities) and Audit Findings
• Readiness Score
• Security Incidents
• Policy Ack Rate (policy acknowledgment completion)
• Access Reviews Done

AI Narrative

The AI drafts a narrative from the metrics. Edit it in the text area to add context, strategic decisions or leadership commentary, then click Save Narrative.

Management Decisions

Click Add Decision to record formal decisions from the review meeting, such as new resource allocations, a change in ISMS scope or an updated risk appetite. Each decision has a topic, the decision itself, an owner and a due date. Click Save Decisions when done.

Signatures

The review needs two signatures: CTO and CEO. Type the signer’s full name and click Sign. Share Link copies a link to this review for that role; the person opening it must be signed in to AutoCISO as an Owner or Manager. Once signed, use Download Report PDF. A signed management review is required for Stage 2 and surveillance audits.

Fields

Management Review Narrative

The formal record of the management review discussion. Should cover: current ISMS performance, audit results, risk treatment progress, and decisions made. This document will be reviewed by the ISO 27001 auditor.

Management Decision

A formal decision or action item arising from the review meeting.

Examples: Increase security training budget by 20%, Expand ISMS scope to include the new US entity, Conduct additional phishing simulation exercise.

Decision Owner

The person accountable for executing the management decision (free text, e.g. a name or role).

Due Date

The deadline for completing the management decision.