ASIS SPC.1-2009 - Organizational Resilience Standard 4.6.3: 4.6.3 Review outputs: system improvement, updated risk assessment and plans, modified procedures and controls, resources and measurement

Output from management review must cover decisions and actions on: making the system more effective; bringing the risk assessment, the impact analysis and the incident preparedness and response plans up to date; changing procedures and controls that bear on risk in answer to events inside or outside, such as shifts in business and operational needs, in risk reduction and security needs, in operating conditions, in laws and regulations, in contractual duties, or in risk levels and acceptance criteria; what resources are needed; and better ways of measuring how well controls work.