An Information Security Management System (ISMS) is a systematic framework of policies, procedures, and controls that an organisation uses to manage and protect its confidential and sensitive information. It is not just an IT system; it is a holistic approach to managing information security risk across the entire organisation. The ISMS is designed to ensure the confidentiality, integrity, and availability (the CIA triad) of all information assets, regardless of their format.
Key Components
- Policies: High-level rules and guidelines set by management.
- Procedures: Detailed, step-by-step instructions for employees to follow.
- Controls: Specific technical or organisational measures put in place to manage risk (e.g., firewalls, employee training).
ISO 27001 Context
The ISO 27001 standard provides the detailed requirements for establishing, implementing, maintaining, and continually improving an ISMS. The entire standard is built around this core concept, using the Plan-Do-Check-Act (PDCA) cycle to ensure the system is effective and responsive to new threats and business changes.
Stuart Barker
Stuart Barker is qualified ISO 27001 Lead Auditor and a veteran practitioner with over 30 years of experience in systems security and risk management. Holding an MSc in Software and Systems Security, he combines academic rigour with extensive operational experience, including a decade leading Data Governance for General Electric (GE).
Now he is founder and Lead ISO 27001 Consultant at High Table, the worlds number 1 dedicated ISO 27001 Consultancy.
