--- title: ISMS Manual description: INFORMATION SECURITY MANAGEMENT SYSTEM MANUAL - ISO 27001:2022 --- [Skip to content](https://support.healthsafe.co/isms-manual#main-content) English Show submenu for translations [More support](https://support.healthsafe.co/kb-tickets/new?hsLang=en) [![HealthSafe\_Logo&Wordmark\_DarkColour\_2000x581@3x](https://support.healthsafe.co/hs-fs/hubfs/HealthSafe_Logo%26Wordmark_DarkColour_2000x581@3x.png?width=300&height=87&name=HealthSafe_Logo%26Wordmark_DarkColour_2000x581@3x.png)](https://support.healthsafe.co/?hsLang=en) Open main navigation Close main navigation - English Show submenu for translations - [More support](https://support.healthsafe.co/kb-tickets/new) Welcome to HealthSafe. How can we help? - There are no suggestions because the search field is empty. 1. [HealthSafe Help Center](https://support.healthsafe.co/?hsLang=en) 2. [HS ISO27001 Documents](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en) 3. [Level 1 ISMS Manual](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-1-isms-manual) # ISMS Manual ## INFORMATION SECURITY MANAGEMENT SYSTEM MANUAL - ISO 27001:2022 **INFORMATION SECURITY MANAGEMENT SYSTEM MANUAL** **ISO 27001:2022** | **Document Identification** | **HSNZ/ISMS/01** | | | --- | --- | --- | | **Document Name** | **Information Security Management System Manual** | | | **Master Copy** | **CISO** | | | **Version Number** | **1.3** | | | **Date Of Release** | **05 May 2026** | | | **Prepared By** | **Eparama Tuibenau** | **CISO** | | **Approved by** | **Gideon Burke** | **CEO** | **TITLE: CONTENTS** | **ISO Clause No** | **Description** | | --- | --- | | 1.0 | Why Information Security | | 1.1 | Organisation Profile | | 1.2 | Applicability and Approval of Manual | | 1.3 | Abbreviation | | 1.4 | Version History | | 1.5 | Administration of ISMS Manual | | 2.0 | References | | 3.0 | Terms and Definitions | | 3.1 | Interaction Chart | | 3.2 | Scope | | **4.0** | **Context of the Organisation** | | 4.1 | Understanding the Organisation and its context | | 4.2 | Understanding the needs and expectations of interested parties | | 4.3 | Determining the scope of the ISMS | | 4.4 | ISMS | | **5.0** | **Leadership** | | 5.1 | Leadership and Commitment | | 5.2 | Policy | | 5.3 | Organisational Roles, Responsibilities and Authorities | | **6.0** | **Planning** | | 6.1 | Actions to address Risks and Opportunities | | 6.2 | ISMS Objectives and Planning to achieve them | | **7.0** | **Support** | | 7.1 | Resources | | 7.2 | Competence | | 7.3 | Awareness | | 7.4 | Communication | | 7.5 | Documentation Information | | **8.0** | **Operation** | | 8.1 | Operational Planning and Control | | 8.2 | Information Security Risk Assessment | | 8.3 | Information Security Risk Treatment | | **9.0** | **Performance Evaluation** | | 9.1 | Monitoring, Measurement, Analysis and Evaluation | | 9.2 | Internal Audit | | 9.3 | Management Review | | **10.0** | **Improvement** | | 10.1 | Nonconformity and Corrective Action | | 10.2 | Continual Improvement | **1.0 WHY INFORMATION SECURITY?** **Information –** is an asset, of value to the organisation, consequently requires adequate protection **Information includes:** Software: SecurePass, RiskManagementSystem (RMS), RiskGuard Paper: Contracts, Agreements Supporting Utilities: Network,  Hardware: Server, Laptop, Mobile, Access Control Kits People: Management Team, Production Team, Ops Team - Utilities themselves do not carry information, but they support other devices that carry information. - Information can be static (e.g. stored on hard disk) or being transmitted (e.g. email) - Whatever form the information takes, it must always be protected. - Physical and IT security alone are not sufficient.  HealthSafe requires a management framework to improve information security. **Information Security;** - Protects information from a range of threats - Ensures business continuity - Minimises financial loss - Maximises return on investments and business opportunities. Information Security needs to be managed. **Types of Protection:** Confidentiality - based on ‘need to know’ and ‘need to do’ principle Integrity - accuracy and completeness Availability - making system available to authorized users when they  need it **1.1 INTRODUCTION – ORGANISATION PROFILE** **1.2 APPLICABILITY AND APPROVAL OF MANUAL** - The purpose of this manual is, to give a general account of the Information Security Management System (ISMS) of the organisation. - ISMS Manual is a Level-1 document, intended to communicate the Security Policy, Objectives, Responsibilities, and Procedures of the organisation to its employees, customers and other stakeholders. - This manual is supported by detailed ISMS Procedures and Guidelines documents. ISMS described in this manual meet the requirements ISO 27001:2022 I hereby approve this manual HSNZ/ISMS/01 and authorise CISO to review release of this manual. Approved by:  CEO – HealthSafe NZ Ltd Date of approval: 05.05.2026   **1.3 Abbreviation:** ISO - International Organisation for Standardization IEC - International Electrotechnical Commission ISMS - Information Security Management System CISO - Chief Information Security Officer SOA - Statement of Applicability RA - Risk Assessment DCR - Document Change Request BCP - Business Continuity Plan DR - Disaster Recovery CIA - Confidential, Integrity and Availability NCR - Non-Conformity Report CAPA - Corrective Action & Preventive Action IPR - Intellectual Property Rights **1.4 MANUAL VERSION HISTORY** | **Sl No** | **Version No.** | **Prepared by** | **Approved by** | **Description of Version** | **Date** | **Reason for Version Change** | | | --- | --- | --- | --- | --- | --- | --- | --- | | **From** | **To** | | | | | | | | 1 | 1.0 | - | CISO | MD | First Release | 14 Apr 2020 | No changes made | | 1 | 1.0 | 1.1 | CISO | MD | Updated | 30 Jul 2021 | Modifications made due to changes in HealthSafe | | 1 | 1.1 | 1.2 | CISO | MD | Updated | 4 Aug 2022 | Modifications made due to changes in HealthSafe | | 1 | 1.2 | 1.3 | CISO | CEO | Updated | 05 May 2026 | Updated references from 2013 to 2022 standard | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | **DOCUMENT STATUS** | **Date** | **Document Status** | | --- | --- | | 14 Apr 2020 | Updated | | 30 Jul 2021 | Updated | | 4 Jul 2021 | Updated | | 4 Aug 2022 | Updated | | 05 May 2022 | Current | | | | **1.5 ADMINISTRATION OF ISMS MANUAL** **Objective** To establish procedures for preparation, distribution and control of the ISMS Manual of the organisation. **Responsibility** Chief Information Security Officer (CISO) shall be responsible for the contents, distribution and general administration of ISMS Manual. CEO HealthSafe NZ Ltd shall approve and authorize release of the ISMS Manual. Controlled copies of this manual shall be issued to all HealthSafe staff. Issue to any others shall be at the discretion of CISO. CISO shall control and maintain record of distribution of this ISMS Manual. Uncontrolled copies are issued for general information and commercial purpose, clearly showing the status. A manual, with uncontrolled status, has no contractual binding on the organization. CISO shall ensure that the amendments/revisions, in respect of this manual, after due deliberations with all concerned personnel of HealthSafe. By raising a document change request DCR, CISO shall ensure that DCRs are properly stapled to the manual's last cover page with due markings in amendment record sheet. CISO shall also ensure that the ISMS Manual is duly corrected as per pending DCR's whenever a new revision manual is issued to all holders of controlled copies of this manual. CISO shall ensure that the amendments/revisions are carried out, at appropriate places, in the controlled copies of ISMS Manual, maintained by personnel of HealthSafe. The ISMS Manual shall be reviewed 6 monthly to determine suitability and improvements needed if any. **2.0 REFERENCES** This ISMS manual has reference to the requirements of: - ISO/IEC 27000:2012, Overview and Vocabulary - ISMS standards ISO 27001:2022 - ISO/IEC 27002:2022 - Information Technology – Code of Practice for Information Security Management. **3.0 TERMS AND DEFINITION** For the purpose of the ISMS the fallowing terms and definitions apply.  **Availability:** Ensuring that authorized users have access to information and associated assets when required. **Confidentiality:** Ensuring that information is accessible only to those authorized to have access. **Information security:** Security preservation of confidentiality, integrity and availability of information. **Information Security Management System (ISMS):** That part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security. **Integrity:** Safeguarding the accuracy and completeness of information and processing methods. **Risk:** Effect of uncertainty on objectives. **Risk Identification:** Process of finding, recognizing and describing risks. **Risk Acceptance:** Decision to accept a risk **Risk analysis:** Systematic use of information to identify sources and to estimate the risk. **Risk assessment:** Overall process of risk analysis and risk evaluation. **Likelihood**: Change of something happening risk analysis. **Level of Risk**: Magnitude of a risk expressed in terms of the combination of consequences and their likelihood **Risk evaluation:** Process of comparing the estimated risk against given risk criteria to determine the significance of risk. **Risk Management:** Coordinated activities to direct and control an organisation with regard to risk. **Risk treatment:** Treatment process of selection and implementation of measures to modify risk. **Residual Risk**: The risk remaining after risk treatment **ALARP**: As Low As Reasonable & Practicable **Statement of applicability:** Documented describing the control objectives and controls that are relevant and applicable to the organisations ISMS, based on the results and conclusions of the risk assessment and risk treatment processes. **3.1 PROCESS INTERACTION MATRIX** | **Department** | Top Management | CISO | Admin | HR | Finance | Purchase | Development | Testing | IT | Training | | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | | Top Management | -- | X | | | | | | | | | | CISO | X | -- | | | | | | | | | | Admin | | | -- | | | | | | | | | HR | | | | -- | | | | | | | | Finance | | | | | -- | | | | | | | Purchase | | | | | | -- | | | | | | Development | | | | | | | -- | | | | | Testing | | | | | | | | -- | | | | IT | | | | | | | | | -- | | | Training | | | | | | | | | | | **3.2 SCOPE** **“The design, development, implementation and maintenance of software/technology solutions in New Zealand”**  **4.0 CONTEXT OF THE ORGANISATION** **4.1 UNDERSTANDING THE ORGANISATION AND ITS CONTEXT** HealthSafe determines external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcomes of its ISMS. HealthSafe evaluates the relevant issues, both internal and external, that may have an impact while meeting the objectives. By defining the relevant issues to its purpose, HealthSafe can set directional goal for establishing ISMS framework. In addition the internal and external issues that might affect the potential to meet the expected outcomes are understood. This sets the stages as given below: - Understanding the external context - Understanding the internal context - Understanding the purpose and intended outcome of the ISMS - Analysing the factors to be considered to meet those objectives. **4.2 UNDERSTANDING THE NEEDS AND EXPECTATIONS OF INTERESTED PARTIES** HaelthSafe determines interested parties that are relevant to the information security management system and the requirements of these interested parties relevant to information security. **External:** - Legal authorities - Clients/customers - Contractors/suppliers - Public **Internal:** - Internal organisational units - Executive management - Board of Directors - Employees **Regulations**: HealthSafe shall address all the legal compliances such as Data Protection Act, Privacy Act, etc. ***Refer: Compliance Management Policy – HSNZ/POL/08*** **4.3 DETERMINING THE SCOPE OF THE INFORMATION SECURITY MANAGEMENT SYSTEM** The organisation shall determine the boundaries and applicability of the ISMS to establish its scope. When determining this scope, HealthSafe considered the external and internal issues referred to in understanding the organisation and its context. The requirements referred to understanding the needs and expectations of interested parties. Interfaces and dependencies between activities performed by the organisation, and those that are performed by other organisations. HealthSafe defines the scope and boundaries which includes all employees for ISMS to meet internal and external requirements. The scope and boundaries determine the applicability of ISMS in terms of the  - Region - Location (physical address) - Department/Function/Responsibility - Technology - Resources - Contractors etc. The scope shall be made available as documented information. **4.4 INFORMATION SECURITY MANAGEMENT SYSTEM** HealthSafe has established, implements, maintains and continually improves the ISMS, in accordance with the requirements of this International Standard. It is a documented system, i.e. all processes are formal. It is a management system within the overall business risks and not a technical system. It is not pure IT hardware/software but the processes of managing the IT systems and business processes. - Identify business activities - Identify business risks Define a specific area of business where ISMS is to be implemented first. **5.0 LEADERSHIP** **5.1 LEADERSHIP AND COMMITMENT** Top management demonstrates leadership and commitment with respect to the information security management system by: - Ensuring the information security policy and the information security objectives are established and are compatible with the strategic direction of the organisation - Ensuring the integration of the ISMS requirements into the organisation’s processes - Ensuring that the resources needed for the ISMS are available - Communicating the importance of effective information security management and of conforming to the ISMS requirements - Ensuring that the ISMS achieves its intended outcomes - Directing and supporting persons to contribute to the effectiveness of the ISMS - Promoting continual improvement - Supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility **5.2 POLICY** HealthSafe established an information security policy that is appropriate to the purpose of the organization and includes information security objectives or provides the framework for setting information security objectives and includes a commitment to satisfy applicable requirements related to information security and includes a commitment to continual improvement. The information security management system is documented and communicated with in the organization and available to interested parties. ***Refer: HSNZ/ANX/01*** **5.3 ORGANIZATIONAL ROLES, RESPONSIBILITIES AND AUTHORITIES** HealthSafe ensures that the responsibilities and authorities for roles relevant to information security are assigned and communicated. HealthSafe assigns the responsibility and authority for ensuring that the ISMS conforms to the requirements of this International Standard; and reporting on the performance of the ISMS to top management. - Top Management has assigned the responsibilities to one person and communicates to the appropriate persons about the ISMS responsibilities and authorities - Define the reporting relations, the contents, and the periodicity of the reports - Determine ISMS resource requirements for each phase covered in each clause - Define different levels – Management Committee, ISMS Project Leader, ISMS Internal Auditor(s), Security Outsourcing etc - Provide ISMS resources - Provide ISMS awareness training to end users and relevant third-party staff - Provide technical training to ISMS team ***Refer: HSNZ/ANX/02*** **6.0 PLANNING** **6.1 ACTIONS TO ADDRESS RISKS AND OPPORTUNITIES** **6.1.1 GENERAL** When planning for the ISMS, HealthSafe considered the issues and determine the risks and opportunities that need to be addressed to ensures the ISMS can achieve its intended outcomes and prevent, or reduce, undesired effects; and achieve continual improvement. HealthSafe plan for actions to address these risks and opportunities; and how to integrate and implement the actions into its ISMS processes; and evaluate the effectiveness of these actions. The planning will focus on - How HealthSafe plans to prevent, or reduce, undesired effects - How HealthSafe ensures that it can achieve its intended outcomes and continual improvement - What will be done to address this - Who will do and when it will be done **6.1.2 INFORMATION SECURITY RISK ASSESSMENT** HealthSafe defines and apply an information security risk assessment process that established and maintains information security risk criteria that include the following: - The risk acceptance criteria - Criteria for performing information security risk assessments - Ensures that repeated information security risk assessments produce consistent, valid and comparable results Information security risks include: **Identifies the information security risks:** - Apply the information security risk assessment process to identify risks associated with the loss of confidentiality, integrity and availability for information within the scope of the information security management system - Identify the risk owners **Analyses the information security risks:** - Assess the potential consequences that would result if the risks identified were to materialize - Assess the realistic likelihood of the occurrence of the risks identified - Determine the levels of risk **Evaluates the information security risks:** - Compare the results of risk analysis with the risk criteria established - Prioritize the analysed risks for risk treatment HealthSafe retains documented information about the information security risk assessment process. ***Refer: Risk Assessment & Treatment Policy – HSNZ/POL/29*** ***Refer: Risk Assessment – HSNZ/ANX/04*** **6.1.3 Information security risk treatment** HealthSafe defines and apply an information security risk treatment process as follows: - Select appropriate information security risk treatment options, taking account of the risk assessment results - Determine all controls that are necessary to implement the information security risk treatment options chosen - Compare the controls determined with those and verify that no necessary controls have been omitted - Produce a Statement of Applicability that contains the necessary controls and justification for inclusions, whether they are implemented or not, and the justification for exclusions of controls from control objectives; - Formulate an information security risk treatment plan - Obtain risk owners’ approval of the information security risk treatment plan and acceptance of the residual information security risks HealthSafe retains documented information about the information security risk treatment process. ***Refer: Risk Assessment & Treatment Policy – HSNZ/POL/29*** ***Refer: Risk Assessment – HSNZ/ANX/04*** **6.2 INFORMATION SECURITY OBJECTIVES AND PLANNING TO ACHIEVE THEM** HealthSafe established information security objectives at relevant functions and levels. - The information security objectives considered be consistent with the information security policy be measurable (if practicable) - Take into account applicable information security requirements, and results from risk assessment and risk treatment - Be communicated; and be updated as appropriate HealthSafe retains documented information on the information security objectives. When planning how to achieve its information security objectives, HealthSafe determines: - What will be done - What resources will be required - Who will be responsible - When it will be completed - How the results will be evaluated ***Refer: ISMS Policy & Objectives – HSNZ/ANX/01*** **7.0 SUPPORT** **7.1 RESOURCES** HealthSafe determines and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the information security management system. ***Refer: IT Resource Request Policy – HSNZ/POL/03*** ***Refer: Physical Asset Management Policy – HSNZ/POL/05*** **7.2 COMPETENCE** HealthSafe determines the necessary competence of person doing work under its control that affects its information security performance; ensures that these persons are competent on the basis of appropriate education, training, or experience; where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness of the actions taken; and retain appropriate documented information as evidence of competence. Technical training for relevant areas is required for those managing security i.e., ISMS Project Team, Incident Management Team, ISMS Internal Audit Team etc. For Example: - Firewall administration - On boarding of staff - Network vulnerability management - Monitoring data centre environment - Risk assessment **7.3 AWARENESS** Persons doing work under the HealthSafe controls be aware of the following: - The information security policy - Their contribution to the effectiveness of the ISMS, including the benefits of improved information security performance - The implications of not conforming with the ISMS requirements. ***Refer: Induction & Training Policy – HSNZ/POL/02*** **7.4 COMMUNICATION** HealthSafe determines the need for internal and external communications relevant to the ISMS includes the following: - What to communicate - When to communicate - With whom to communicate - Who shall communicate - The processes by which communication shall be carried out **7.5 DOCUMENTED INFORMATION** **7.5.1 GENERAL** HealthSafe’s ISMS includes: - Documented information required by this International Standard - Documented information determined by the HealthSafe as being necessary for the effectiveness of the ISMS. **7.5.2 CREATING AND UPDATING** When creating and updating documented information the HealthSafe ensures appropriate  - Identification and description - Format and media - Review and approval for suitability and adequacy **7.5.3 CONTROL OF DOCUMENTED INFORMATION** Documented information required by the ISMS and by this International Standard shall be controlled to ensures it is available and suitable for use, where and when it is needed; and it is adequately protected.  For the control of documented information, the HealthSafe addresses the following activities, as applicable: - Distribution, access, retrieval and use; - Storage and preservation, including the preservation of legibility - Control of changes - Retention and disposition. Documented information of external origin, determined by the organisation to be necessary for the planning and operation of the ISMS, be identified as appropriate, and controlled. ***Refer: Document & Data Control Policy – HSNZ/POL/30*** **8.0 OPERATION** **8.1 OPERATIONAL PLANNING AND CONTROL** HealthSafe shall plan, implement and control the processes needed to meet information security requirements, and to implement the actions determined.  HealthSafe also implement plans to achieve information security objectives determined and keep documented information to the extent necessary to have confidence that the processes have been carried out as planned. HealthSafe control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary. HealthSafe ensures that outsourced processes are determined and controlled. **8.2 INFORMATION SECURITY RISK ASSESSMENT** HealthSafe perform information security risk assessments at planned intervals or when significant changes are proposed or occur, taking account of the criteria established. HealthSafe retains documented information of the results of the information security risk assessments. ***Refer: Risk Assessment & Treatment Policy – HSNZ/POL/29*** **8.3 INFORMATION SECURITY RISK TREATMENT** HealthSafe implemented the information security risk treatment plan. HealthSafe retains documented information of the results of the information security risk treatment. ***Refer: Risk Assessment & Treatment Policy – HSNZ/POL/29*** **9.0 PERFORMANCE EVALUATION** **9.1 MONITORING, MEASUREMENT, ANALYSIS AND EVALUATION** HealthSafe evaluates the information security performance and the effectiveness of the ISMS. HealthSafe determines what needs to be monitored and measured, including information security processes and controls; the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results; when the monitoring and measuring shall be performed; who shall monitor and measure; when the results from monitoring and measurement shall be analysed and evaluated; and who shall analyse and evaluate these results. Monitoring and measurement is considered for Anti-malware, Firewalls, Intrusion Detection/Prevention, Anti-SPAM, Patch Management, Application Security Scanners, Databases, Network Access Control, Operating Systems, Data Leakage Protection, Configuration Hardening, Secure Web Gateways, Web Application Firewalls and Mobile Data Protection can be monitored and the results can be measured. Various logs collected from these sources can be analysed and evaluated. HealthSafe retains appropriate documented information as evidence of the monitoring and measurement results. ***Refer: Antivirus Policy – HSNZ/POL/14*** ***Refer: Backup Policy – HSNZ/POL/15*** ***Refer: System Monitoring and Event Monitoring Policy – HSNZ/POL/17*** **9.2 INTERNAL AUDIT** ISMS Internal Audits are performed in the organisation, in order to determine whether the control objectives, controls, process and procedures of ISMS effective to meet the HealthSafe security policy and objectives. ***Activities*** CISO shall plan, organize and conduct the Internal Information Security Audits of all the activities addressing all the elements of the ISMS Standard. Frequency of the Audits shall be determined by CISO on the basis of Status, Importance and Past Results. The audits shall be conducted once every month. CISO shall ensure that audits are conducted as per the Audit Plan. Audits shall be performed for all the HealthSafe functional areas by the Trained ISMS Auditor, a person independent of the activity being audited. The auditor, during the audit shall seek: - To determine the effectiveness of the ISMS - To verify whether the ISMS activities and the related results comply with planned arrangements - To verify whether procedural instructions are implemented with the generation of evidence of ISMS related activities - To assess whether the performance meets ISMS requirements On completion of audit, the Audit Report prepared by the auditor shall be reviewed by CISO and with the summary shall be submitted to the auditee. The auditee shall agree for a time-bound Corrective Action, if any required. The management responsible for the area being audited shall ensure that actions are taken without undue delay to eliminate detected nonconformities and their causes. Improvement activities shall include verification of the action taken and the reporting of verification results. Follow-up audit activities shall verify and record the implementation and effectiveness of the Corrective Action taken. CISO shall verify the follow-up action on the Audit Report, and shall be authorized to close the Non-conformance Report related to the audit, after confirmation of the effectiveness of the Corrective Action Summary of Audit Reports including Observations, Non-Conformances and Corrective Action, shall be reviewed for effectiveness of ISMS in ISF meeting. The ISMS internal audits shall be the same as the practice communicated in ISMS System Procedure. ***Refer: ISMS Internal Audit Policy – HSNZ/POL/32*** **9.3 MANAGEMENT REVIEW** Formal reviews of ISMS are conducted by CISO & ISMS Team as often as necessary for the overall system and at least once quarterly to ensure its continuing suitability adequacy and effectiveness as well as to ensure their continued compliance. The review shall include assessing opportunities for improvements and the need for changes to the ISMS, including security policy and security objectives. **Review Input**  The agenda for an ISMS Team meeting is prepared by CISO and generally covers, but is not limited to, the following review inputs: 1. Results of ISMS audits and reviews 2. Feedback of ISMS audits and reviews 3. Techniques, products or procedures, which could be used in the organization to improve the ISMS performance and effectiveness 4. Status of preventive and corrective actions 5. Vulnerabilities or threats not adequately addressed in the previous risk assessment 6. Follow-up actions from previous management reviews 7. Any changes that could affect the ISMS 8. Recommendations for improvement **Review Output**  The output of management review includes any decisions and actions related to  - Improvement of the effectiveness of the ISMS. - Modification of procedures that effect information security, as necessary, to respond to internal or external events that may impact on the ISMS, including changes to: \- Business requirements \- Security requirements \- Business processes effecting the existing business requirements \- Levels of risk and/or levels of risk acceptance - Resource requirements The proceedings shall be recorded and copies are distributed to members, follow up actions shall also be monitored and brought forward for the next ISF review meeting as required. ***Refer: Management Review Meeting Policy – HSNZ/POL/34*** **10 IMPROVEMENT** **10.1 NONCONFORMITY AND CORRECTIVE ACTION** When nonconformity occurs, HealthSafe reacts to the nonconformity and as follows: Take action to control, correct it and deal with the consequences Evaluate the need for action to eliminate the causes of nonconformity, in order that it does not recur or occur elsewhere, by: - Reviewing the nonconformity - Determining the causes of the nonconformity - Determining if similar nonconformities exist, or could potentially occur Implement any action needed, review the effectiveness of any corrective action taken and make changes to the information security management system, if necessary. Corrective actions shall be appropriate to the effects of the nonconformities encountered. HealthSafe retains documented information as evidence of the nature of the nonconformities and any subsequent actions taken, and the results of any corrective action. ***Refer: Non-Conformities, Corrective & Preventive Action Policy – HSNZ/POL/32*** **10.2 CONTINUAL IMPROVEMENT** HealthSafe continually improves the suitability, adequacy and effectiveness of the ISMS. - [SecurePass for Visitor Management](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#main-content) - [How to Use SecurePass](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#how-to-use-securepass) - [Site/System Admin Guides](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#site-system-admin-guides) - [Set-up and Manage SecurePass Device](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#set-up-and-manage-securepass-device) - [SecurePass overview and FAQ’s](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#securepass-overview-and-faqs) - [Explore the People Menu](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#explore-the-people-menu) - [Explore the Sign in Settings Menu](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#explore-the-sign-in-settings-menu) - [Pre Registration Calendar/Group Booking](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#pre-registration-calendar-group-booking) - [Troubleshooting](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#troubleshooting) - [The Onboarding/Rollout process for SecurePass](https://support.healthsafe.co/securepass-for-visitor-management?hsLang=en#the-onboarding-rollout-process-for-securepass) - [SecurePass for Contractor Management](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#main-content) - [Contractor Business Admin Guides](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#contractor-business-admin-guides) - [Contractor Employee Guides](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#contractor-employee-guides) - [System Admins Gudies for Contractors](https://support.healthsafe.co/securepass-for-contractor-management?hsLang=en#system-admins-gudies-for-contractors) - [Dynamic Risk Management System](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#main-content) - [Admin Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#admin-guides) - [User Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#user-guides) - [Manager Guides](https://support.healthsafe.co/dynamic-risk-management-system?hsLang=en#manager-guides) - [Command Centre Integration](https://support.healthsafe.co/command-centre-integration?hsLang=en) - [Integriti Integration](https://support.healthsafe.co/integriti-integration?hsLang=en) - [ProtegeGX Integration](https://support.healthsafe.co/protegegx-integration?hsLang=en) - [HS ISO27001 Documents](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#main-content) - [Official Certificate](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#official-certificate) - [Level 1 ISMS Manual](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-1-isms-manual) - [Level 2 Supporting Policies](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-2-supporting-policies) - [Level 3 Supporting Procedures](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-3-supporting-procedures) - [Level 4 Supporting Forms](https://support.healthsafe.co/hs-iso27001-documents?hsLang=en#level-4-supporting-forms) [![HealthSafe\_Logo&Wordmark\_LightColour\_512x149-1](https://support.healthsafe.co/hs-fs/hubfs/HealthSafe_Logo%26Wordmark_LightColour_512x149-1.png?width=200&height=58&name=HealthSafe_Logo%26Wordmark_LightColour_512x149-1.png "HealthSafe_Logo&Wordmark_LightColour_512x149-1")](http://healthsafe.co.nz) HealthSafe Help Centre Copyright © 2026, HealthSafe NZ Limited