Information Security Management System (ISMS)
Definition
The set of policies, processes, procedures, and controls that an organisation establishes to manage information security risk. ISO 27001 specifies the requirements that this system must satisfy. The ISMS is not a software platform; it is an organisational framework that may be supported by many tools.
- Abbreviation
- ISMS
- Standard
- ISO/IEC 27001
- Nature
- Organisational framework, not a software product
- Components
- Policies, processes, procedures, controls
Common questions
Why is it a mistake to treat an ISMS as a single software tool an organisation can simply buy?+
An ISMS is the governance structure that decides what risks matter, who owns them, and how controls are chosen and reviewed, and no single tool performs that organisational function, so software can support parts of an ISMS but cannot substitute for the framework itself.
How does ISO 27001 certification relate to the ISMS an organisation builds?+
ISO 27001 specifies the requirements an ISMS must meet, such as risk assessment methodology, control selection, and continual improvement, and certification is an external audit confirming the organisation's actual ISMS satisfies those requirements rather than the standard itself being the management system.
Related terms
- Annex a
- The normative annex to ISO/IEC 27001 that lists 93 information security controls across four themes: organisational (37 controls), people (8), physical (14),...
- High-Level Structure (HLS)
- The common clause framework mandated by ISO for all management system standards. Clauses 4 through 10 of ISO 27001 follow the same...
- ISO/IEC 27002
- A guidance standard (not certifiable) that provides implementation advice for each of the 93 controls in ISO 27001 Annex A. Updated in...
- Risk Owner
- The individual or role accountable for ensuring a risk is treated appropriately and that the treatment remains effective. Owners should control the...
- Statement of Applicability (SoA)
- A mandatory document listing every ISO/IEC 27001 Annex A control with a statement of whether it is included or excluded, the justification...