ISO 22301:2019
Performance evaluation, ISO 22301:2019

ISO 22301:2019 9.3.2: Management review input

The review must take into account: where actions from earlier reviews stand; changes in the internal and external issues that matter to the BCMS; information on BCMS performance, including trends in nonconformities and corrective actions, results of monitoring and measurement, and audit results; feedback from interested parties; whether changes are needed, to policy and objectives among others, and which procedures and resources could lift performance and effectiveness; what the impact analysis and the risk assessment show; the result of evaluating continuity documentation and capabilities; risks or issues that no earlier risk assessment dealt with properly; lessons and actions coming out of disruptions and near misses; and chances for continual improvement.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 35 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST Cybersecurity Framework 2.0 · 7 controls

  • NIST-CSF-GV.OV-01 Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction
  • NIST-CSF-GV.OV-02 The cybersecurity risk management strategy is reviewed and adjusted to ensure coverage of organizational requirements and risks
  • NIST-CSF-GV.OV-03 Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed
  • NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
  • NIST-CSF-ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities
  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated
  • NIST-CSF-RS.AN-08 An incident's magnitude is estimated and validated

ISO 27002:2022 · 5 controls

  • 5.24 Information security incident management planning and preparation
  • 5.26 Response to information security incidents
  • 5.27 Learning from information security incidents
  • 5.35 Independent review of information security
  • 5.36 Compliance with policies, rules and standards for information security

PCI DSS 4.0 · 5 controls

  • 12.10.6 12.10.6 Plan evolved from lessons learned and industry developments
  • 12.4.2.1 12.4.2.1 Documentation of quarterly operational reviews
  • 12.5.2 12.5.2 Annual and change-driven scope confirmation
  • 12.5.3 12.5.3 Scope review after significant organisational change
  • 9.4.1.2 9.4.1.2 Annual review of offline backup location security

CIS Controls v8 · 2 controls

  • CIS-17.4 Establish and Maintain an Incident Response Process
  • CIS-17.8 Conduct Post-Incident Reviews

CMMC 2.0 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)
  • SOC2-CC4.2 CC4.2 Evaluating and communicating control deficiencies (COSO principle 17)

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P23 Senior Management Information to the Board on Resilience Decisions

C5 (Germany) · 1 control

  • C5-COM-03 Internal audits of the information security management system

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-36 Internal Reporting and Review by Senior Management and the Board

FedRAMP High · 1 control

  • CA-7 Continuous Monitoring

FedRAMP Moderate · 1 control

  • CA-7 Continuous Monitoring

HIPAA Security Rule · 1 control

ISO 28002:2011 · 1 control

  • A.7.2 A.7.2 Management review input

ISO/IEC 42001:2023 · 1 control

  • 9.3.2 Management review inputs

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-66 Rev 2 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Performance evaluation, ISO 22301:2019

You are reading one control. How much of ISO 22301:2019 have you already done?

ISO 22301:2019 9.3.2 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 22301:2019 your existing evidence covers. Hold APRA CPS 230 Operational Risk Management and 28 of 57 ISO 22301:2019 controls already carry evidence.

If you hold APRA CPS 230 Operational Risk Management49.1% covered · 29 gapsIf you hold NIST Cybersecurity Framework 2.047.4% covered · 30 gapsIf you hold C5 (Germany)42.1% covered · 33 gapsIf you hold CFTC System Safeguards (17 CFR 37, 38, 39, 49)38.6% covered · 35 gapsIf you hold NIST SP 800-161 Rev 136.8% covered · 36 gapsIf you hold SOC 235.1% covered · 37 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the APRA CPS 230 Operational Risk Management pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 35 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 22301:2019 controls