Policy Corporate Governance Information Security – Management Review Procedure

Information Security – Management Review Procedure


Print Friendly and PDFPrint Friendly

Intent

This Procedure has been established to provide a structured process for conducting management review of James Cook University’s (JCU; the University) Information Security Management System (ISMS) in alignment with ISO 27001 requirements. This process ensures the ongoing relevance, effectiveness, and alignment of the ISMS with the University’s strategic objectives and priorities.

Scope

This Procedure applies to all Authorised Users of the University’s information management systems regardless of location, whether during or after business hours or whether on JCU-owned or privately owned devices.

Definitions

Refer to the Digital Policy Glossary for a comprehensive list of definitions, terms and explanations relating to information security at JCU.

Introduction

Conducting periodic management reviews is a key component of the ISO 27001: Information security, cyber security and privacy protection – Information security management systems – Requirements.

Through systematic evaluation and analysis, the management review facilitates informed decision-making, risk management, and continual enhancement of information security practices. Comprehensive documentation and recordkeeping promote transparency and accountability, further demonstrating JCU’s commitment to maintaining a robust ISMS.

Procedure

ActionWhenResponsible Officer

1. Conduct an annual review of JCU’s ISMS including:

  • Status and actions from previous management reviews.
  • Findings, actions, trends and opportunities for improvement from relevant:
    • internal assessments, attestations, and audits;
    • non-conformances and corrective actions;
    • feedback from stakeholders; and
    • results of risk assessments and risk treatment plans.
  • External and internal changes relevant to the ISMS.
  • Changes in needs and expectations of stakeholders relevant to the ISMS.
End JuneInformation Security - Governance, Risk and Compliance (GRC) Manager

2. Analyse findings and deliver a comprehensive report to the Chief Information Security Officer (CISO), outlining systemic issues and recommendations aimed at sustaining and improving the effectiveness of the ISMS.

2.1 The report format, reporting period, and relevant metrics will be determined in consultation with the CISO and may include:

  • Maturity ratings including process vs implementation   effectiveness;
  • Insights, observations, trends, challenges, opportunities   and recommendations.
End JulyInformation Security - Governance, Risk and Compliance (GRC) Manager

3. Present findings to the Chief Digital Officer (CDO) ensuring decisions and actions are documented, monitored and escalated to senior management as necessary.

3.1 Include related strategies into planning processes to enhance JCU’s cybersecurity posture.

End AugustCISO

4. Present findings, recommendations and action plans to senior management including the University Executive and governance committees as relevant.

4.1 Ensure feedback is incorporated and appropriate approval is obtained for major ISMS decisions and resource allocations in alignment with the University’s delegations and sub-delegations.

End SeptemberCDO

Related Policy Instruments

Information Security Policy

Information Security Management Framework

Queensland Government Information Security Policy (IS 18:2018)

ISO/IEC 27001 Information security, cybersecurity, and privacy protection – Information security management systems – Requirements

ISO/IEC 27002 Information security, cybersecurity, and privacy protection – Information security controls

Schedules/Appendices

Nil

Administration

NOTE:  Printed copies of this procedure are uncontrolled, and currency can only be assured at the time of printing.

Approval Details

Policy Domain

Corporate Governance

Policy Sub-domain

Risk, Assurance, Regulatory and Compliance

Policy Custodian

Vice Chancellor

Approval Authority

Council

Date for next Major Review

09/05/2030

Revision History

Version

Approval date

Implementation date

Details

Author

25-1

09/05/202513/05/2025

Procedure established.

Information Security - Governance, Risk and Compliance Manager

Keywords

ISO 27001, cyber security, ISMS, risk management, continuous improvement, Information Security Management System compliance

Contact person

Information Security - Governance, Risk and Compliance Manager