What is an ISMS?
An ISMS, or information security management system, is the set of scope, policies, risk process, controls and reviews an organisation uses to manage information security. It is what ISO 27001 certifies: the certificate covers the management system, not a product or a piece of software.
What an ISMS includes
ISO 27001 describes the ISMS in clauses 4 to 10. You define the context and the scope, leadership sets an information security policy and assigns roles, and you run a risk assessment and decide how each risk is treated. You then provide the people and resources to operate the controls, measure how well it all works, and correct what does not.
The controls themselves come from Annex A, which lists 93 reference controls, plus any you add. The Statement of Applicability records which ones you use and why. The rest of the ISMS is the management layer around them, and that is the part first-time teams tend to underestimate.
- Scope. Which teams, locations, systems and services are covered (clause 4.3).
- Policy and objectives. What leadership commits to and how progress is measured (clauses 5.2 and 6.2).
- Risk process. A repeatable method for assessing and treating risk (clauses 6.1.2 and 6.1.3).
- Review and improvement. Internal audit, management review and corrective action (clauses 9.2, 9.3 and 10.2).
Why it is called a system
A list of good controls does not make an ISMS. What auditors look for is a cycle that keeps running: risks are reassessed when things change, controls are checked, findings are fixed, and leadership reviews the results and decides what to change.
This is why certification takes time even for a company with strong engineering security. The Stage 2 auditor wants records showing the cycle has run at least once, including an internal audit and a management review, before the certificate is issued.
Getting the scope right
The scope statement decides what the certificate covers, and buyers read it. A narrow scope is quicker to certify, but a customer may find that the service they buy sits outside it. A scope that matches the product customers actually use avoids that question in security reviews.
An ISMS built for ISO 27001 also carries over to other standards. ISO 42001 uses the same clause structure for an AI management system, so the two can share one risk process, one internal audit programme and one management review.
Questions
ISMS, answered
Is an ISMS a piece of software?
No. An ISMS is the way an organisation manages information security: its scope, policies, risk process, controls and reviews. Software can hold the records, but the certificate is issued to the organisation for its management system.
Do we need an ISMS without ISO 27001 certification?
No standard forces you to have one, but running security as a managed cycle helps with any framework. Many teams build the ISMS first and decide on certification once customers start asking for it.
How long does a certificate last?
An ISO 27001 certificate lasts three years. The certification body runs a surveillance audit in each of the two years between certification and recertification.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them