# TEM-01: ISMS MANAGEMENT REVIEW MEETING (MRM) MINUTES
## JOHN THOMAS FINTECH PRIVATE LIMITED
**CIN:** U62099KL2026PTC106017 | **Doc ID:** JT-ISMS-TEM-001  
**Meeting Reference:** MRM-2026-01 | **Meeting Date:** 14-Oct-2026 | **Time:** 10:00 AM - 12:30 PM IST  
**Location:** Corporate Boardroom, 69/1854 A, SRM Road, Kochi, Kerala / Secure Video Conference  
**ISO/IEC 27001:2022 Clause Mapping:** Clause 9.3 (Management Review)

---

## 1. Attendees & Quorum
| Name | Designation / Role | Attendance Status |
|:---|:---|:---:|
| **John Thomas** | Managing Director & Chief Executive Officer (Chairperson) | Present |
| **Saramma Thankachen** | Director | Present |
| **Appointed CISO** | Chief Information Security Officer / Lead Auditor | Present |
| **Lead Systems Architect** | Head of Engineering & Architecture | Present |
| **DevOps & Cloud Lead** | Infrastructure & Cloud Security Lead | Present |

*Quorum verified: Top Management and all key ISMS domain leads present.*

---

## 2. Formal Meeting Agenda & Discussions (Clause 9.3.2 Inputs)

### Agenda Item 1: Review of Previous Action Items
- As this is the inaugural formal ISO/IEC 27001:2022 Management Review following incorporation, there are no prior MRM action items. Baseline established.

### Agenda Item 2: Changes in External & Internal Issues (Clause 4.1 & 4.2)
- Review of the Indian **Digital Personal Data Protection (DPDP) Act 2023** and CERT-In 6-hour cybersecurity reporting directions.
- Confirmed that cloud data localization within Indian AWS regions (`ap-south-1` Mumbai and `ap-south-2` Hyderabad) satisfies all RBI and statutory data residency guidelines.

### Agenda Item 3: Evaluation of Information Security Performance & Objectives (Clause 6.2, 9.1)
- Platform uptime target ($\ge 99.95\%$) achieved with 99.99% operational reliability.
- Zero production customer data breaches reported.
- 100% of employees completed baseline information security and AUP onboarding.

### Agenda Item 4: Internal Audit Findings & Status of Corrective Actions (Clause 9.2, 10.2)
- Full-scope baseline internal audit completed per checklist `CHK-01`.
- Zero Major Nonconformities identified; 1 Minor NC regarding quarterly access review formalization logged and remediated under `CAR-2026-03`.

### Agenda Item 5: Risk Assessment & Treatment Plan Review (Clause 6.1, 8.2)
- Reviewed the master Risk Register (`REG-01`) comprising 10 fintech risk scenarios.
- High inherent risks successfully mitigated to acceptable residual levels ($\le 10$).
- Approved the Statement of Applicability (`REG-02`) endorsing all 93 controls.

---

## 3. Management Decisions & Approved Action Items (Clause 9.3.3 Outputs)

| Action Item ID | Decision / Approved Action | Responsible Owner | Budget / Resource Allocation | Target Due Date |
|:---|:---|:---:|:---|:---:|
| **ACT-MRM-01** | Proceed with immediate engagement of accredited Certification Body for Stage 1 & Stage 2 ISO/IEC 27001:2022 Certification Audits. | Managing Director & CISO | Approved Certification Audit Fee | 15-Nov-2026 |
| **ACT-MRM-02** | Procure advanced automated cloud security posture management (CSPM) and container scanning tooling. | DevOps Lead | Approved Annual Tooling Budget | 30-Nov-2026 |
| **ACT-MRM-03** | Schedule annual third-party external VAPT audit with CERT-In empaneled security agency. | CISO | Approved Security Audit Budget | 15-Dec-2026 |

---

## 4. Top Management Conclusion & Sign-Off

The Board of Directors of **JOHN THOMAS FINTECH PRIVATE LIMITED** affirms that the Information Security Management System (ISMS) is fully suitable, adequate, and operating effectively in alignment with the strategic objectives of the Company and the international requirements of **ISO/IEC 27001:2022**.

| Name | Role | Signature & Date |
|:---|:---|:---|
| **John Thomas** | Managing Director & CEO | *Digitally Signed* — 14-Oct-2026 |
| **Saramma Thankachen** | Director | *Digitally Signed* — 14-Oct-2026 |