9.3 Management review

Clause 9.3 of ISO 28000:2022 requires top management to conduct periodic reviews of the security-management system, confirming its continued suitability, adequacy and effectiveness. The review must assess performance data, audit findings, nonconformities, corrective actions and any opportunities for improvement.