Policy review
This measure asks whether policies are reviewed on schedule.
What the published 2016 guidance says
This measure asks whether policies are reviewed on schedule. It counts the policies reviewed in the previous year against the policies in place, as a percentage. The illustrative bands are green above 80, orange from 40 to 80 and red below 40. The evidence is the document history or a document list with the last review date. Collection follows the planned review interval. The policy owner holds the information, internal audit collects, and the security lead is the client. A pie chart shows the current position and a line chart shows the trend.
What it means in practice
A simple completeness measure for policy review. Record the review date in the document history and count the policies reviewed in the period. The thresholds are examples; the value is that the review date is visible and the percentage can be defended.
Status of this record. For B.3, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the policy list with the last review date and the next review date. Count the reviews completed in the period. Record the evidence in the document history, not in a separate spreadsheet.
Evidence an assessor asks for
- Policy managementDocument control list with last-review dates
- DocumentationPolicy review plan
- Policy managementDocument history sections showing reviews
The question an assessor will ask
An assessor will ask for document control list with last-review dates. The test for B.3 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Policies with a version date and no review record
- Review interval defined nowhere, so nothing is overdue
Before the next review
Before the next review, test this against one live record: policies with a version date and no review record.
What to check when the revision publishes
When DIS 27004 is published, compare the B.3 Policy review record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.