ISMS Steering Committee Charter Template (ISO/IEC 27001)

Committee purpose, membership, quorum, cadence, decision rights, inputs, standing agenda, minutes and action log, link to management review 9.3

SGSI e ISO/IEC 27001CompletaISO/IEC 27001:2022 + Amd 1:2024 clauses 5.1, 5.3, 9.3, A.5.4 (cited only); ISO/IEC 27014:2020steering committee charterActualizada 1 nov 2026

Abrir en el editorDescargar .md

Cómo usar: Use it when ISMS decisions need more than one executive between management reviews: risk acceptance, policy approval, budget and priorities. Fill the decision rights first and check them against the roles and RACI and the risk methodology. The main pitfall is presenting committee minutes as the management review without the clause 9.3 inputs and outputs.

Vista previa

ISMS Steering Committee Charter: [Organization name]

Sets up the body that steers the information security management system (ISMS) between management reviews: its purpose, members, quorum, meeting cadence, standing agenda, decision rights, inputs, minutes and action log. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 5.1 (leadership and commitment), clause 5.3 (roles and authorities), clause 9.3 (management review) and Annex A control A.5.4 (management responsibilities for security). The standard does not require a steering committee; it is a common way to show leadership and to prepare the management review. Replace every [bracketed] value and every row marked Example.

Document control

Field	Value
Document ID	DOC-ISMS-007
Version	[1.0]
Status	[Draft / In review / Approved / Superseded]
Owner	[@ciso or committee chair]
Approvers/reviewers	[@ceo], [@cfo], [@isms-manager], [@internal-auditor (reviewer)]
Last updated	YYYY-MM-DD
Classification	[Internal]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.1, 5.3, 9.3; A.5.4)
Next scheduled review	YYYY-MM-DD (every [12] months)
Committee chair	[@coo or ceo]
Committee secretary	[@isms-manager]
Meeting cadence	[Quarterly, plus extraordinary meetings]
Related documents	DOC-ISMS-006 roles and RACI, DOC-ISMS-010 risk methodology, DOC-ISMS-015 risk appetite and criteria, DOC-ISMS-085 management review minutes

Approvals

Role	Name	Decision	Date
Top management sponsor	[@ceo]	[Approved / Approved with changes]	YYYY-MM-DD
Committee chair	[@coo]	[Accepted]	YYYY-MM-DD
ISMS manager (prepared by)	[@isms-manager]	[Prepared]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0	YYYY-MM-DD	[@isms-manager]	First issue
[x.y]	YYYY-MM-DD	[@author]	[Change summary]

1. Purpose and authority
2. Relationship to management review and other bodies
3. Membership
4. Quorum and decision making
5. Cadence and meeting types
6. Decision rights
7. Inputs
8. Standing agenda
9. Minutes template
10. Action log
11. Annual work plan
12. Size tiers
13. Committee effectiveness review
14. Records and evidence
15. References
Standard and licence note

1. Purpose and authority

The ISMS steering committee (the committee) is appointed by top management of [Organization name] to:

Direct and monitor the ISMS between management reviews, so that it delivers what top management set out to achieve (clause 5.1).
Make the security decisions delegated to it in section 6: approval of topic-specific policies, acceptance of risks within its limits, prioritisation of risk treatment and use of the approved ISMS budget.
Coordinate security across functions (IT, engineering, HR, legal, operations, procurement, facilities) so that controls do not stop at departmental borders.
Prepare the inputs for the management review (clause 9.3) and follow up its decisions.
Escalate to top management or the board any matter beyond its authority.

Item	Value
Appointed by	[Top management or board resolution, reference and date]
Scope of authority	ISMS within the scope in DOC-ISMS-002
Accountable to	[CEO / executive committee / board risk committee]
Reports	Summary of decisions and escalations after each meeting; annual activity report
Authority limits	Section 6; anything not listed is escalated

The committee does not replace line management. Risk owners, asset owners and control owners keep their responsibilities as defined in DOC-ISMS-006.

2. Relationship to management review and other bodies

The clause 9.3 review is the moment when top management itself steps back and judges whether the ISMS is still the right one for the business and is working. It runs on a fixed rhythm, works from a set agenda that the standard prescribes (follow-up of earlier decisions, what has changed, how security has performed, audit and risk results, ideas for improvement), and ends in recorded decisions. The committee is not a substitute; it prepares and follows up.

Aspect	ISMS steering committee (this charter)	Management review (clause 9.3, DOC-ISMS-085)
Required by ISO/IEC 27001	No; an organisational choice	Yes
Who	Committee members in section 3	Top management (may include committee members)
Frequency	[Quarterly] plus extraordinary meetings	At planned intervals, typically [once a year]; some organisations hold it twice a year
Purpose	Steer, decide within delegated limits, coordinate, prepare	Judge whether the ISMS still fits the business, is sufficient and works; decide on improvement and changes
Inputs	KPIs, risk changes, incidents, audit status, project status, exceptions	All inputs listed in clause 9.3.2
Outputs	Decisions, acceptances, action items, escalations	Decisions on improvement opportunities and changes to the ISMS (9.3.3), retained as documented information
Record	Committee minutes and action log (sections 9 and 10)	Management review minutes (`compliance/management-review`)

How they connect:

Other bodies:

Body	Relationship	Interface
Board or board risk committee	Receives the annual security report and escalations of Critical risks	CISO reports [twice a year]
Audit committee	Receives internal audit results directly	Internal auditor reports independently (DOC-ISMS-006 section 7)
Change advisory board	Escalates changes with High security risk	Change records reference committee decisions
Privacy or data governance board	Shares privacy risks and DPIA outcomes	DPO attends both
Other management system committees (quality, continuity)	Joint agenda items in an integrated management system	Combined meetings allowed if minutes separate ISMS decisions

3. Membership

3.1 Core members (voting)

Seat	Role holder	Why on the committee
Chair	[COO / CEO]	Executive authority across functions; chairs and casts deciding vote
CISO or security lead	[@ciso]	Security strategy, risk reporting, incident escalation
Head of IT operations	[@it-ops-lead]	Owns most technical controls and their budget
Head of engineering or product	[@cto]	Secure development, product risks, customer commitments
HR lead	[@hr-lead]	People controls, training, disciplinary process
Finance lead	[@cfo]	Budget, insurance, fraud-related controls
Legal or compliance lead	[@general-counsel]	Legal register, contracts, regulatory notifications
Business unit representative	[@bu-head]	Business impact and risk ownership

3.2 Advisors and attendees (non-voting)

Seat	Role holder	Attends
Secretary	ISMS manager [@isms-manager]	Every meeting; prepares packs, minutes and action log
DPO or privacy lead	[@dpo]	Every meeting (privacy items)
Internal auditor	[@internal-auditor]	By invitation for audit results; observes, does not vote, to keep independence
Risk owners and control owners	As needed	For their agenda items
Supplier representatives	As needed	For supplier performance or incident items

3.3 Membership rules

Top management appoints the chair; the chair appoints other members with top management's agreement.
Each core member names a deputy with authority to vote in their absence (see DOC-ISMS-006 section 8).
Members declare conflicts of interest at the start of each meeting; a conflicted member does not vote on that item.
New members receive an induction from the ISMS manager covering this charter, the risk methodology and current High and Critical risks.

4. Quorum and decision making

Rule	Value
Quorum	Chair (or deputy) plus at least [half] of the core members, including the CISO or deputy
Decision method	Consensus; if not reached, simple majority of voting members present; chair has the deciding vote
Risk acceptance	Requires the risk owner present or represented and the CISO's recorded opinion
Decisions outside meetings	Written procedure by e-mail or workflow tool, approved by a quorum within [5] working days, recorded in the next minutes
Urgent decisions	Chair and CISO may decide jointly when a delay would cause harm; ratified at the next meeting
Dissent	Any member may ask for a dissent to be minuted
Inquorate meeting	Discussion may continue; decisions are taken by written procedure

Decision flow for an item that needs a decision:

5. Cadence and meeting types

Meeting type	When	Duration (Example)	Purpose
Regular meeting	[Quarterly]; [monthly] during the implementation project	90 minutes	Standing agenda (section 8)
Extraordinary meeting	Within [2] working days of a Critical risk, a major incident or a major audit finding	60 minutes	Specific decision
Annual planning meeting	[January]	2 hours	Objectives, budget, audit programme, calendar for the year
Management review preparation	[4 to 6] weeks before management review	Part of a regular meeting	Agree the input pack

Papers are sent [5] working days before a regular meeting. Items received later move to the next meeting unless the chair agrees otherwise.

6. Decision rights

Decision	Committee role	Limit or condition	Escalates to
Approve topic-specific policies (DOC-ISMS-005)	Approves	Policy consistent with DOC-ISMS-001	Top management for DOC-ISMS-001 itself
Approve the information security policy	Recommends	Top management approves (clause 5.2)	Top management
Accept Low and Medium residual risks	Informed	Risk owner accepts Low; risk owner plus department head accept Medium (DOC-ISMS-010)	Top management for Medium in an Averse category (DOC-ISMS-015 section 9 rule 1)
High residual risks (score 10 to 16)	Reviews the treatment decision and recommends acceptance or treatment	Treatment plan with dates required	Top management accepts
Critical residual risks (score 17 to 25)	Reviews; requires a treatment plan	Not accepted by the committee	Top management documented decision
Prioritise risk treatment plan items (DOC-ISMS-013)	Decides	Within approved budget	Top management if budget is exceeded
Spend from approved ISMS budget	Approves	Up to USD [50,000] per item (Example)	CEO above the limit
Policy exceptions with Low or Medium residual risk	Informed; reviews the exception register each meeting	Approved by the risk owner (Low) or the risk owner plus department head (Medium); compensating controls and expiry of up to [12] months required	Top management for Medium in an Averse category
Policy exceptions with High residual risk	Reviews and recommends	Treatment plan and expiry of up to [6] months required (DOC-ISMS-019)	Top management accepts
Policy exceptions with Critical residual risk	Not approvable as an exception	Treat or stop the activity	Top management, as a risk decision under DOC-ISMS-019, never as an exception
Approve the internal audit programme	Endorses	Top management approves	Top management
Approve ISMS objectives (DOC-ISMS-024)	Recommends	Consistent with the policy	Top management approves
Approve changes to the ISMS (6.3, DOC-ISMS-025)	Approves	Changes that do not alter scope or policy	Top management for scope changes
Approve the Statement of Applicability	Reviews	CISO and sponsor approve	Top management
Accept supplier security risks for critical suppliers	Decides on High findings	Per supplier assessment (DOC-ISMS-067)	Top management for Critical findings

7. Inputs

Input	Provided by	Source	Frequency
ISMS dashboard: KPIs and objectives status	ISMS manager	DOC-ISMS-081 performance report, DOC-ISMS-080 measurement programme	Every meeting
Risk register changes: new, raised, overdue treatment, expiring acceptances	ISMS manager	DOC-ISMS-016, DOC-ISMS-013	Every meeting
Risk acceptance requests (High and Critical)	Risk owners	DOC-ISMS-019	As raised
Incidents and near misses since last meeting	Incident manager	DOC-ISMS-021, DOC-ISMS-022	Every meeting
Internal and external audit results and open findings	ISMS manager, internal auditor	DOC-ISMS-084, DOC-ISMS-086	After each audit
Corrective actions status	ISMS manager	DOC-ISMS-087	Every meeting
Exceptions granted and expiring	CISO	DOC-ISMS-122	Every meeting
Supplier security issues	Procurement	DOC-ISMS-066, DOC-ISMS-067	Quarterly
Projects and changes with security impact	Project owners	DOC-ISMS-046, change records	As needed
Legal and regulatory changes	Legal	DOC-ISMS-014	Quarterly
Threat intelligence summary	Security operations	DOC-ISMS-045	Quarterly
Budget versus plan	Finance	DOC-ISMS-031	Quarterly
Management review actions	ISMS manager	DOC-ISMS-085	Every meeting until closed

8. Standing agenda

No.	Item	Lead	Time (Example)	Expected outcome
1	Opening, quorum, conflicts of interest	Chair	5 min	Quorum confirmed, conflicts recorded
2	Approval of previous minutes	Chair	5 min	Minutes approved
3	Action log review	Secretary	10 min	Actions closed, re-planned or escalated
4	ISMS dashboard and objectives	ISMS manager	10 min	Off-track objectives get an owner and action
5	Risk review: new, changed, overdue, acceptances	CISO	20 min	Acceptances recommended or decided; treatments prioritised
6	Incidents and lessons learned	Incident manager	10 min	Improvement actions assigned
7	Audit results and corrective actions	ISMS manager	10 min	Overdue actions escalated
8	Policies, exceptions and changes for approval	Policy owners	10 min	Approvals recorded
9	Suppliers, projects, legal changes	Members	5 min	Items noted or actions assigned
10	Escalations to top management and any other business	Chair	5 min	Escalations listed

Total time in this example: 90 minutes (5 + 5 + 10 + 10 + 20 + 10 + 10 + 10 + 5 + 5).

9. Minutes template

Copy this block for each meeting.

Field	Value
Meeting ID	SC-2027-Q1 (Example)
Date, time, place	2027-03-18, 10:00 to 11:30, [room or video link]
Chair	[@coo]
Secretary	[@isms-manager]
Members present	[Names or roles]
Apologies and deputies	[Names, deputy attending]
Quorum	[Yes / No]
Conflicts declared	[None / member and item]
Previous minutes	[Approved / Approved with changes]

Decisions:

Decision ID	Agenda item	Decision	Basis (document or record)	Owner	Date due
SC-2027-Q1-D01 (Example)	5 Risk review	Recommend that top management accept RISK-024 (legacy reporting server, score 12, High) for 6 months with treatment RTP-022	DOC-ISMS-019 request ACC-007	CISO	2027-03-25
SC-2027-Q1-D02 (Example)	8 Policies	Approve the remote working policy version 1.0	DOC-ISMS-054 draft	HR lead	2027-03-18
SC-2027-Q1-D03 (Example)	5 Risk review	Prioritise phishing-resistant MFA for administrators ahead of the DLP pilot	DOC-ISMS-013 items RTP-009, RTP-017	Head of IT operations	2027-06-30
[SC-YYYY-QN-DNN]	[Item]	[Decision]	[Reference]	[Owner]	YYYY-MM-DD

Escalations to top management:

Escalation ID	Subject	Reason	Requested decision	Sent on
SC-2027-Q1-E01 (Example)	RISK-024 acceptance	High residual risk needs top management acceptance	Accept for 6 months with RTP-022	2027-03-19

Minutes approved by: [chair], date YYYY-MM-DD.

10. Action log

Action ID	Source	Action	Owner	Due	Status	Evidence of closure
ACT-2027-001 (Example)	SC-2027-Q1-D03	Roll out phishing-resistant MFA to all 42 administrator accounts	Head of IT operations	2027-06-30	In progress (28 of 42 done)	Identity provider report
ACT-2027-002 (Example)	Management review 2026 output 4	Add supplier security KPIs to the dashboard	ISMS manager	2027-03-31	Closed	Dashboard v2.1
ACT-2027-003 (Example)	SC-2027-Q1 item 7	Close overdue corrective action CA-2026-011 (access review evidence)	Asset owner, finance systems	2027-04-30	Open
[ACT-YYYY-NNN]	[Source]	[Action]	[Owner]	YYYY-MM-DD	[Open / In progress / Closed / Escalated]	[Reference]

Status rules: an action overdue by more than [30] days is reported to the chair; an action re-planned twice is escalated to top management.

11. Annual work plan

Meeting	Special focus in addition to the standing agenda
Annual planning (January)	Objectives, budget, internal audit programme, calendar
Q1 (March)	Risk acceptances expiring, policy review results
Q2 (June)	Risk reassessment results and treatment priorities
Q3 (September)	Internal audit results, management review input pack
Q4 (December)	Management review outputs, surveillance audit results, next year's plan

12. Size tiers

Topic	Small: Quillmere Analytics Ltd (46 staff)	Medium: Quillmere Health Systems (320 staff)	Large: Quillmere Group (2,400 staff, 6 sites)
Form	Standing ISMS item in the monthly leadership meeting (CEO, CTO, COO, Head of Engineering Operations)	Dedicated quarterly committee, monthly during the 10-month certification project	Group security council plus a committee per site; council chaired by the group COO
Chair	CEO	COO	Group COO; site directors chair site committees
Secretary	Head of Engineering Operations (ISMS manager, 0.5 FTE)	Full-time ISMS manager	Group ISMS manager in the 14-person security office
Members	4	8 core members plus privacy lead	Council: group COO (chair) plus 9 core members: CISO, group CIO, OT lead, group HR, legal, finance and 3 site representatives in rotation
Decision limits (Example)	Spend up to USD 10,000	Spend up to USD 50,000	Council up to USD 250,000; site committees up to USD 25,000
Minutes	Section in leadership minutes with decision IDs	Separate minutes and action log	Council minutes; site minutes roll up to the council action log
Integration	None needed	Joint item with the quality lead for audit planning	Integrated with ISO 9001 and ISO 22301 governance; separate ISMS decision section

13. Committee effectiveness review

Once a year, before the annual planning meeting, the chair and secretary review:

Question	Measure (Example)	Target (Example)
Did meetings take place as planned?	Meetings held versus planned	4 of 4
Were meetings quorate?	Quorate meetings	100%
Were actions closed on time?	Actions closed by due date	At least 80%
Were papers sent on time?	Packs sent 5 working days before	At least 90%
Did decisions reach the management review?	Escalations and summaries in the 9.3 input pack	All
Are the right functions present?	Attendance per seat	At least 75% per seat

Findings feed the continual improvement register (DOC-ISMS-088) and, if needed, a revision of this charter.

14. Records and evidence

Record	Proves	Kept by	Where	Retention (Example)
Approved charter (this document)	Delegated authority from top management	Secretary	Document management system	Current plus [3] previous versions
Meeting packs	Inputs reviewed	Secretary	Committee folder	[3] years
Approved minutes with decision IDs	Decisions taken within authority	Secretary	Committee folder	[6] years or as required by corporate records policy
Action log	Follow-up of decisions	Secretary	Committee folder or tracker	[3] years after closure
Written-procedure decisions	Decisions outside meetings	Secretary	Committee folder	Same as minutes
Escalations to top management and responses	Authority limits respected	Chair	Committee folder	[6] years
Annual effectiveness review	Committee performance	Chair	Committee folder	[3] years

Map these records to clauses 5.1, 5.3 and 9.3 and control A.5.4 in the control evidence matrix (DOC-ISMS-033).

15. References

Reference	Edition	Use
ISO/IEC 27001:2022 + Amd 1:2024	Current (https://www.iso.org/standard/82875.html, Amd 1: https://www.iso.org/standard/88435.html)	Clauses 5.1, 5.3, 9.3; A.5.4
ISO/IEC 27002:2022	Current (https://www.iso.org/standard/75652.html)	Management responsibilities guidance
ISO/IEC 27003:2017	Current; a revision is in progress, check for a newer edition (https://www.iso.org/standard/63417.html)	Leadership and management review guidance
ISO/IEC 27014:2020	Current; a new edition is at FDIS stage in 2026 (https://www.iso.org/standard/74046.html)	Governance of information security: direct, monitor, evaluate

Related templates: isms/isms-roles-raci, compliance/management-review, isms/isms-performance-report, isms/isms-measurement-programme, compliance/risk-register, compliance/risk-treatment-plan, isms/isms-risk-acceptance-record, isms/isms-annual-calendar, isms/isms-budget-resource-plan, isms/information-security-governance-27014, security/security-exception-request, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 (clauses 5.1, 5.3 and 9.3, Annex A control A.5.4), with guidance from ISO/IEC 27003:2017 and ISO/IEC 27014:2020. The charter text, tables, agenda, minutes format and examples are original. No ISO/IEC text is reproduced: clause and control numbers are cited with short descriptions written for this template. Obtain the official standards from ISO, IEC or your national standards body, and check the current edition before use (ISO/IEC 27003 and ISO/IEC 27014 are under revision). Quillmere entities are fictional; budget figures are examples in USD, use your local currency.

Template licence: MIT.

Plantillas relacionadas

SGSI e ISO/IEC 27001