ISMS governance meetings: who should meet, how often, and what to record

Between management reviews, most organisations need a regular, shorter governance meeting to keep the ISMS moving: a security forum, an ISMS steering group, or simply a monthly half-hour with the people who own the key areas. It's where overdue actions get unstuck and decisions get made before they become problems.

ISO 27001 doesn't name this meeting, but it's how many small organisations show the leadership and communication the standard asks for.

Why it matters

Regular governance meetings support several clauses of ISO/IEC 27001:2022:

• 5.1 (leadership): top management shows commitment and makes sure the ISMS has the resources it needs.
• 5.3 (roles and responsibilities): owners report on the areas they're responsible for.
• 7.4 (communication): you decide what to communicate, to whom and when.
• 9.1 (monitoring and measurement): results are looked at and acted on, not just collected.

Records of these meetings are useful evidence that the ISMS is running, not just written.

A simple monthly agenda

1. Overdue and upcoming actions
2. Incidents and near misses since last time
3. Risks: new, changed, or due for review
4. Supplier, audit or customer issues
5. Progress on objectives
6. Decisions needed and actions agreed

Thirty minutes is usually enough. Record decisions and actions, not a transcript.

What an auditor looks for

• Meetings happen at the frequency you've set.
• The right people attend, including someone with authority to make decisions.
• Decisions and actions are recorded, with owners and dates.
• Actions are followed up at the next meeting.

Common reasons it fails: meetings planned but not held; minutes with no actions; or the same actions carried forward month after month.

Common mistakes, and how to keep it manageable

• Too many attendees. Invite the owners of the areas being discussed; keep it small.
• Status reports nobody reads. Use the meeting for decisions; share figures beforehand.
• Minutes in a separate document. Keep them with the meeting record, and turn actions into tasks so they're tracked.

How to do it in ClearIMS

1. Open Meetings and set up the meeting: date, attendees and agenda.
2. Send it from ClearIMS, so the invitation and correspondence stay with the meeting.
3. Record decisions and actions and attach any papers. Turn actions into tasks with owners and due dates, so ClearIMS emails people when they're due.
4. Feed management review. Use the meeting records as evidence at your next management review.

Related pages

• Management reviews: the formal annual review.
• Communication plan: what you communicate, to whom and when.
• Responsibility matrix: who owns what.
• Tasks: where meeting actions are tracked.