1. Purpose

This procedure establishes the requirements for conducting Management Reviews of the AegisGate Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022 Clause 9.3. Management Reviews ensure that top leadership evaluates the ISMS’s continuing suitability, adequacy, and effectiveness, and drives continuous improvement through informed decision-making.

Management Reviews are the primary governance mechanism through which AegisGate leadership demonstrates commitment to information security and validates that the ISMS achieves its intended outcomes.

2. Scope

This procedure applies to:

• All ISMS processes, controls, and supporting documentation
• All information security objectives and their measurement
• All risk assessment results and risk treatment plans
• The ISO 27001 Statement of Applicability (AG-ISO27001-SoA-2026-001)
• The Internal Audit Program (AG-IAUD-2026-001)
• All personnel with responsibilities defined in the ISMS Policy (AG-ISMSPOL-2026-001)

3. Review Frequency

Management Reviews are conducted quarterly. The annual review cycle follows this schedule:

An extraordinary review is convened when any of the following occur:

• A significant information security incident (Severity: Critical or High)
• A material change to the ISMS scope
• A regulatory or legal requirement change affecting information security
• A significant change to the business context or risk profile
• A request from top management

4. Review Inputs

Each Management Review receives the following inputs, prepared by Compliance & Security Engineering and distributed to attendees at least five business days before the review:

4.1 Internal Audit Results

• Summary of internal audit findings per the Internal Audit Program (AG-IAUD-2026-001)
• Status of corrective actions from previous audits
• Trend analysis of audit findings over the previous four quarters

4.2 Compliance Assessment Results

• ISO 27001 Statement of Applicability status update (implemented, partial, planned, N/A)
• Compliance engine coverage metrics (857+ CheckFuncs across 27 frameworks)
• Changes in regulatory or legal requirements affecting AegisGate

4.3 Risk Assessment Results

• Updated risk register with current risk scores and treatment status
• New risks identified during the quarter
• Changes to existing risk ratings (increase or decrease)
• Risk acceptance decisions and rationale

4.4 Information Security Performance

• Progress against information security objectives (OBJ-01 through OBJ-08 per ISMS Policy)
• Key performance indicators:
  • Platform availability metrics
  • Unauthorized access incidents
  • Vulnerability remediation timelines (Critical ≤ 48h, High ≤ 7d, Medium ≤ 30d)
  • Audit log integrity verification results
  • Training completion rates

4.5 Incident Reports

• Information security incidents reported during the quarter
• Severity classification and response timeline for each incident
• Root cause analysis results
• Status of corrective actions from incidents

4.6 Interested Party Feedback

• Customer security inquiries and audit findings
• Subprocessor security assessment results
• Regulatory correspondence

4.7 Threat Intelligence

• Emerging threats relevant to AegisGate’s risk profile
• Threat intelligence feed updates (153+ detection patterns)
• Industry threat advisories and vulnerability disclosures

4.8 Continuous Improvement Status

• Status of improvement actions from previous Management Reviews
• Continuous Improvement Roadmap progress
• ISMS process effectiveness metrics

5. Review Outputs

Management Review outputs are documented decisions and actions addressing:

5.1 Required Outputs

5.2 Documentation

All Management Review outputs are recorded in:

• Management Review minutes (formal record of discussion, decisions, and actions)
• Action item tracker with assigned owners, deadlines, and status
• Updated risk register (if risk treatment decisions changed)
• Updated Statement of Applicability (if control status changed)

6. Agenda Template

Management Reviews follow this agenda structure. The facilitator may adjust time allocations based on review priority.

7. Attendees and Roles

7.1 Required Attendees

7.2 Optional Attendees

7.3 Quorum

A Management Review is quorate when the Chief Executive Officer and Compliance & Security Engineering Lead are both present. If the CEO is unavailable, a delegate with written authority may attend.

8. Records and Evidence Retention

8.1 Records Maintained

8.2 Evidence Integrity

All Management Review records are stored in AegisGate’s hash-chained audit log system, ensuring:

• Integrity: Cryptographic hash chains prevent undetected modification of records.
• Authenticity: Records are attributable to their authors via authenticated access.
• Availability: Records are available for internal and external audit at any time.
• Retention: Records retained for a minimum of seven years per the ISMS records retention policy.

9. Escalation Procedures

9.1 Escalation Criteria

The following conditions require escalation beyond the standard Management Review:

9.2 Extraordinary Review Convening

An extraordinary Management Review is convened by the CEO or Compliance & Security Engineering Lead when escalation criteria are met. The extraordinary review follows the same agenda structure as a quarterly review, with focus on the triggering event.

10. Continuous Improvement

This procedure is subject to continuous improvement. At each Management Review, the effectiveness of the review process itself is evaluated:

• Are review inputs complete, accurate, and timely?
• Are review outputs actionable and tracked to completion?
• Is the review frequency sufficient?
• Are the right people attending?
• Is the agenda structure effective?

Improvements to this procedure are documented in the Management Review minutes and implemented per the document control requirements in the ISMS Policy.

11. References

This procedure is maintained per the ISMS document control requirements. Questions regarding this procedure should be directed to Compliance & Security Engineering at compliance@aegisgatesecurity.io.