IT Security Management System: What an ISMS Is and How to Run One

An IT security management system, usually called an information security management system (ISMS), is a set of policies, processes and controls that an organisation uses to manage information security in a planned, repeatable way. The international standard that defines its requirements is ISO/IEC 27001:2022. This guide explains what an ISMS contains, how to build one, which records prove it works and where it sits next to NIS2 and DORA.

What an IT security management system is

An ISMS is a systematic approach to managing sensitive information so that risk is minimised and the business can keep running, as TechTarget defines it. It covers more than IT. People, paper records, suppliers and premises all hold information, so they all sit inside the system.

Information security management, the activity the system supports, is the process of protecting an organisation’s data and assets against threats. Its goals are confidentiality, integrity and availability, and it can be driven by internal policy as well as external regulation, according to Check Point.

The three goals in plain terms:

• Confidentiality: only authorised people can reach the information.
• Integrity: the information is accurate and reliable.
• Availability: the information can be reached when it is needed.

These are the core principles in ISO/IEC 27001:2022, and every control in an ISMS exists to protect at least one of them.

The core components of an ISMS

ISO/IEC 27000:2018 lists the building blocks of an ISMS: management principles, defined resources, personnel responsibilities, risk management processes, security policies, documented information, internal audits and continual improvement. The same document stresses management commitment, and says the system supports business objectives by protecting information assets.

In practice that gives you six working parts.

ISACA makes a useful point in its implementation guide for ISO/IEC 27001:2022: an ISMS is not an end in itself. It supports business processes and corporate goals, and its measures should be economically appropriate as well as effective. A control that costs more than the risk it removes is a poor control.

The same guide describes implementation as joining three perspectives: governance (leadership and objectives), risk (protecting assets within the organisation’s appetite) and compliance (legal, contractual and regulatory requirements). Keeping all three in view stops the ISMS from becoming either a paper exercise or a purely technical project.

How an ISMS relates to ISO 27001

The two terms are often used as if they meant the same thing. They do not. The ISMS is the system your organisation runs. ISO/IEC 27001 is the standard that states the requirements for establishing, implementing, maintaining and continually improving it, and it is the best-known standard for ISMS worldwide.

Certification is optional. ISO describes it as one way to show commitment and ability to manage information securely. A certification audit is a systematic, independent assessment by a third party confirming that the management system meets the standard, according to the ISO/IEC JTC 1/SC 27 Journal 2026. The same source notes that certification can strengthen customer confidence and ease vendor due diligence by reducing third-party risk.

For a company with 10 to 250 staff, that last point is often the commercial reason to start. Larger customers send security questionnaires, and a certificate answers many of them at once. For a plain-language overview of the standard and who it covers, see our page on ISO 27001.

How to build an ISMS, step by step

The sequence below follows the implementation path in ISO/IEC 27000:2018: define the scope, secure management commitment, assess risk and document policies, then maintain through monitoring, internal audit and management review.

1. Define the scope

Decide which business units, sites, systems, data and suppliers the ISMS covers. A narrow, honest scope is easier to run than an ambitious one nobody maintains. You can widen it later, and a growing company usually does.

2. Secure management commitment

The German Federal Office for Information Security (BSI) holds that management must use an ISMS to plan, adopt, implement, supervise and improve information security tasks, in its BSI-Standard 100-1. In practice that means a named owner, a budget and a recurring slot on the leadership agenda.

3. Assess risks

List your information assets, the threats to them and the likelihood and impact of each. Agree a method and use it the same way each time, so that results can be compared year on year. The output is a risk register and a treatment plan that says what you will do about each risk: reduce, accept, avoid or transfer it.

4. Choose controls and write the Statement of Applicability

The Statement of Applicability (SoA) records the controls you consider necessary, why they are included, whether they are implemented and why any Annex A controls are excluded. This comes from the ISO/IEC JTC 1/SC 27 auditing practices note on the SoA. The same note confirms that you may design your own controls or take them from other sources, such as NIST, rather than only from Annex A.

That flexibility matters for anyone managing several scopes. A consultant looking after multiple clients should keep a separate scope, risk register and SoA for each, even where the policy wording is reused. Two clients with similar controls rarely have identical assets, suppliers or legal duties.

5. Document policies and procedures

Write the policies the risk assessment calls for: access control, acceptable use, supplier management, incident response, backup, business continuity and so on. Keep them short enough that people read them. The standard asks for documented information, and clear documented procedures are among the things the ISO Journal links to organisational resilience.

6. Train and communicate

Effective management includes active monitoring of performance, risk and compliance, plus training and communication so that everyone understands their part, per ISO/IEC 27000:2018. Record who was trained and when.

7. Audit internally and review

Run an internal audit of the ISMS, then hold a management review. The findings feed corrective actions. Certification audits use evidence-based evaluation to judge how effective the system is and to identify improvements, as the ISO Journal notes, so the internal audit is your rehearsal.

8. Improve continually

The cycle never closes. New suppliers, new products, incidents and changes in law all feed back into scope, risk and controls.

If you want a quick view of where you stand before starting, our free ISO 27001 readiness test gives a first picture of the gaps.

Records that show the ISMS works

An auditor, or a customer reading your questionnaire answers, wants proof that the system operates. ISACA’s guide lists the evidence an organisation should keep: risk assessments, the Statement of Applicability, security policies, incident logs, training records, internal audit reports and records of management review, as set out in the ISACA implementation guide.

A simple habit helps: for every control in the SoA, name the record that proves it and the person who produces it. Examples:

• Access reviews: a dated export of user accounts with the reviewer’s sign-off.
• Change management: tickets or pull requests showing approval.
• Awareness training: attendance or completion lists.
• Incidents: a log with cause, impact and corrective action.

Collecting these continuously is far less painful than rebuilding them in the weeks before an audit.

ISMS, NIS2 and DORA

Many EU organisations come to an ISMS because of regulation. The NIS2 Directive requires in-scope entities to adopt appropriate technical, operational and organisational measures for managing cybersecurity risks. An ISMS gives you the structure for that: risk analysis, incident handling, supplier oversight and documented policies.

The limit is worth knowing. Under Article 20 of the NIS2 Directive, management bodies must approve the cybersecurity risk management measures, oversee their implementation and can be held responsible for infringements. NIS2 also sets specific reporting obligations. An ISO 27001 certificate shows that a management system meets a standard. It does not by itself show that you meet every legal duty, so map the legal text against your ISMS and close any gap. Our overview of NIS2 shows who is in scope.

The same logic applies to DORA for financial entities and to GDPR for personal data. One well-run ISMS gives you a shared base of risks, policies and evidence, and each regulation then adds its own specific requirements on top. For personal data, the extension standard is covered on our ISO 27701 page.

The principles of good practice also carry across frameworks. A related management-system discipline is described in this piece on ISO implementation and accountability, which shows how management standards share the same plan, do, check and act logic.

Running an ISMS with a platform

A spreadsheet and a shared drive can hold a small ISMS for a while. The strain appears when you add a second standard, a second client or a customer who asks for an evidence pack. Then the same policy, the same risk and the same screenshot are copied between files and go out of date.

Guardiso is a platform for managing information security and regulatory compliance. In one system a company runs ISO 27001, GDPR, NIS2, DORA and its own standards, and one set of documents and evidence serves many regulations. It collects evidence from tools such as Microsoft 365, GitHub and AWS, shows compliance status, risks and open tasks, and prepares an evidence pack for the auditor. Data is stored only in the European Union, and Guardiso is an ISO 27001 certified company.

Plans start at 199 € per month for Starter and 499 € per month for Professional, with Enterprise priced on request. See the pricing page or the compliance platform for integrations and evidence.

If you need hands-on help, we also offer penetration tests and security audits and a virtual security officer service for teams without a full-time security lead.

FAQ

What is the difference between an ISMS and ISO 27001?

An ISMS is the system of policies, processes and controls your organisation runs. ISO 27001 is the standard that sets the requirements for that system. You can run an ISMS without certification, but you can only be certified against the standard.

Do I need ISO 27001 certification to have an ISMS?

No. Certification is optional and shows through an independent third-party audit that your system meets the standard. Many organisations seek it because customers ask for it, and some build an ISMS first and certify later.

Does an ISMS make me compliant with NIS2?

It gives you much of the risk management framework that NIS2 expects, such as risk analysis, incident handling and supply chain security. NIS2 also places specific reporting duties and management accountability on entities, so check the Directive’s text against your system.

What records do auditors expect to see?

Expect to show risk assessments, the Statement of Applicability, policies, incident logs, training records, internal audit reports and management review records. Each should be dated and traceable to a named owner.

Sources

• ISO/IEC 27001:2022 - Information security management systems
• TechTarget: What is Information Security Management System (ISMS)?
• Check Point: What is Information Security Management?
• ISO/IEC 27000:2018
• ISACA implementation guide for ISO/IEC 27001:2022
• ISO/IEC JTC 1/SC 27 Journal 2026, Issue 1
• BSI-Standard 100-1
• ISO/IEC JTC 1/SC 27/WG 1 auditing practices note on the SoA
• EUR-Lex: NIS2 Directive (EU) 2022/2555
• EUR-Lex: Cybersecurity of network and information systems summary
• Exereco: ISO implementation and accountability

Recommended

• SOC 2: what it is, who it covers
• Cyber Essentials: what it is, who it covers
• ISO 22301: what it is, who it covers
• PCI DSS: what it is, who it covers