What Is Information Security Management System?

An information security management system is the framework of policies, processes and controls by which an organisation manages information security systematically. The term comes from ISO 27001, where it is the thing being certified.

The distinguishing idea is that what gets certified is the management system rather than the controls. An auditor examines whether you identify risks, decide on treatments, implement them, measure and improve — not whether you chose particular products.

The components

Defined scope, stating what is covered. Leadership commitment with assigned responsibility. Risk assessment and treatment. Controls selected on the basis of that assessment.

Documentation sufficient to demonstrate operation. Competence and awareness. Monitoring and measurement. Internal audit. Management review. And corrective action when something is found wanting.

Scope is the most consequential decision

Scope determines what is audited, what the certificate covers, and how much work the whole exercise represents. A narrow scope — one product, one data centre, one business line — is faster and cheaper to achieve.

It is also what customers examine. A certificate scoped to something other than the service being purchased provides limited assurance, and sophisticated buyers read the scope statement before the certificate.

The statement of applicability

This records which controls from the standard's catalogue apply, which do not, and why. It is the central artefact of the system and the one auditors examine most closely.

Exclusions are permitted and must be justified. A statement excluding controls because they are inconvenient will not survive audit; one excluding them because the organisation genuinely does not perform the relevant activity will.

The continual improvement requirement

The standard expects the system to improve, evidenced by internal audits that find things, corrective actions that address them, and management reviews that make decisions.

An organisation whose internal audits consistently find nothing raises an obvious question. Auditors read a nil-findings internal audit as evidence that the internal audit function is not working.

Whether the certificate is the point

Frequently it is: customers require it, procurement processes demand it, and it removes a commercial obstacle. That is a legitimate reason and it should be stated honestly.

The system itself has value independent of the certificate, and a programme run purely to obtain one tends to produce documentation rather than capability. The two outcomes are distinguishable and the cost difference between them is smaller than expected.

Cost and timeline, realistically

For a small organisation starting from reasonable practice, certification typically takes six to twelve months and involves consulting support, internal effort, and audit fees in two stages followed by annual surveillance.

The largest cost is usually internal time rather than fees, and it concentrates in documentation and evidence. Organisations that already operate the controls and simply have no records face a documentation project; those that do not operate them face a considerably larger one, and the two are frequently quoted as if identical.

Where to start

Decide the scope before anything else, and write it as a customer would read it. That single decision determines the cost, the timeline and the commercial value of the whole exercise.

See the complete certification guide. GuardsArm delivers ISO 27001 services.