> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Management review

> ISO 27001 clause 9.3 — how Denialbase management reviews the ISMS at planned intervals.

<Warning>
  **Status — April 2026**: The management review program is **launching** alongside internal audit. First review targeted for **Q2 2026**.
</Warning>

**Owner**: CEO (chair) · **Participants**: CEO, CTO, Security Officer, Privacy Officer · **Cadence**: Quarterly

## Purpose

Management review ensures the ISMS remains **suitable**, **adequate**, and **effective** — three words that matter to an ISO 27001 auditor:

* **Suitable** — aligned with Denialbase's objectives, customer commitments, and risk appetite.
* **Adequate** — covers the scope it claims to cover.
* **Effective** — producing the security outcomes we expect.

## Cadence

| Review type                      | Frequency             | Duration  | Attendees                                                              |
| -------------------------------- | --------------------- | --------- | ---------------------------------------------------------------------- |
| **Quarterly operational review** | Every 3 months        | 60–90 min | CTO, Security Officer, Privacy Officer                                 |
| **Annual strategic review**      | Once per year         | 3 hours   | CEO, CTO, Security Officer, Privacy Officer, Board observer (optional) |
| **Ad-hoc post-incident review**  | After any Sev-1/Sev-2 | 60 min    | CEO, CTO, Security Officer                                             |
| **Pre-audit review**             | Before external audit | 2 hours   | CTO, Security Officer                                                  |

## Standing agenda (ISO 27001 clause 9.3.2)

Every review addresses the clauses below. For each, the owner presents the current state, trend since last review, and any proposed changes.

<AccordionGroup>
  <Accordion title="a) Status of actions from previous management reviews">
    What did we decide last time? Which actions are closed, in progress, or overdue?
  </Accordion>

  <Accordion title="b) Changes in external and internal issues relevant to the ISMS">
    New regulations (HIPAA enforcement updates, state privacy laws), new customer segments, new subprocessors, new threats (emerging CVE categories), major organizational changes.
  </Accordion>

  <Accordion title="c) Changes in needs and expectations of interested parties">
    Customer commitments, regulator expectations, workforce requirements, partner requirements.
  </Accordion>

  <Accordion title="d) Feedback on information security performance">
    * Nonconformities and corrective actions
    * Monitoring and measurement results (access review completion, patching cadence, incident counts, MTTR)
    * Audit results (internal and external)
    * Achievement of information security objectives
  </Accordion>

  <Accordion title="e) Feedback from interested parties">
    Customer feedback, regulator feedback, workforce feedback (e.g. from security awareness training surveys).
  </Accordion>

  <Accordion title="f) Results of risk assessment and status of risk treatment plan">
    New risks identified, risks accepted / mitigated / transferred / avoided, residual risk trending.

    *See [Risk register](/trust/risk-register).*
  </Accordion>

  <Accordion title="g) Opportunities for continual improvement">
    Where is the ISMS inefficient? What's the friction? Which controls cost more than they return in risk reduction?
  </Accordion>
</AccordionGroup>

## Inputs prepared by the Security Officer

Before every review, the Security Officer prepares a briefing pack with:

1. **KPI dashboard** (see below).
2. **Open findings** from internal + external audits.
3. **Risk register delta** — added, closed, and changed since last review.
4. **Incident summary** for the period.
5. **Training completion stats**.
6. **Subprocessor changes** and annual review status.
7. **Customer-visible security events** (status page entries, breach notifications if any).

## Key performance indicators

| KPI                                           | Target         | Source                                                      |
| --------------------------------------------- | -------------- | ----------------------------------------------------------- |
| Access reviews completed on schedule          | 100%           | [Access control](/trust/access-control-policy)              |
| Mean time to remediate high vulnerabilities   | ≤ 7 days       | [Vulnerability management](/trust/vulnerability-management) |
| Incident MTTR (Sev-1)                         | ≤ 4 hours      | [Incident response](/trust/incident-response)               |
| Backup verification pass rate                 | 100%           | [Disaster recovery](/trust/disaster-recovery)               |
| Security training completion (annual)         | ≥ 95%          | [Security awareness](/trust/security-awareness)             |
| Open critical risk count                      | 0 sustained    | [Risk register](/trust/risk-register)                       |
| Internal audit nonconformities aged > 90 days | 0              | [Internal audit](/trust/internal-audit)                     |
| Customer-reported security incidents          | Downward trend | Support + security inbox                                    |

## Outputs (ISO 27001 clause 9.3.3)

Each review produces **minutes** recording:

* Decisions related to continual improvement opportunities.
* Any needed changes to the ISMS — scope, controls, resources.
* Changes to security objectives.
* Resource requirements (headcount, tooling, budget).
* Assigned actions with owners and due dates.

Minutes are stored in a restricted Google Drive folder with 6-year retention and are made available to external auditors.

## Actions from management review

All actions are tracked in the same system as audit findings ([Risk register](/trust/risk-register)) to avoid parallel tracking. Each action has:

* Owner
* Target due date
* Success criteria
* Review cadence (who checks on progress and how often)

## Relationship to other processes

```
Risk register ─┐
Audit findings ─┼→ Management review → Updated ISMS ─┐
Incident trends ┤                                      ↓
KPI dashboard ──┘                               Resource allocation
                                                Policy updates
                                                Risk treatment decisions
```

## First review

**Scheduled**: 2026-06-15
**Preparation owner**: Security Officer
**Agenda**: Standing agenda above + ISMS launch readiness + internal-audit readiness plan
**Expected duration**: 3 hours (first review runs longer to establish baseline)