The ISMS: the heart of ISO 27001
ISMS stands for Information Security Management System. In Dutch, it is called “managementsysteem voor informatiebeveiliging”. It is the core of ISO 27001 . It is not a software package or a checklist, but a systematic way of organising information security. The standard is available from NEN and follows the High Level Structure of all ISO management system standards. Want to know where you stand first? Start with a baseline measurement and gap analysis.
What is an ISMS under ISO 27001?
An ISMS is not a software package you install. It is not a folder of documents you put in a drawer. It is a systematic approach to organising, monitoring and improving information security.
Think of an ISMS as the operating system for your information security. It determines:
- Which information you must protect
- Which risks exist
- Which measures you take
- Who is responsible for what
- How you check that it works
- How you keep improving
An ISMS is not a project with a start and an end. It is an ongoing process that moves along with your organisation. As long as you process information, you need an ISMS.
What does an ISMS look like at an IT company with 15 people?
In the abstract, an ISMS sounds like a lot of paperwork. In practice, it is manageable. For example, a working ISMS at a software company with 15 employees consists of these parts:
| Component | What it looks like in practice |
|---|---|
| Information security policy | One page in the company wiki with the principles |
| Risk register | Spreadsheet with the top 15 risks, owner and measure |
| Statement of Applicability | List of the 93 Annex A controls with a choice per control |
| Access management | Password manager, MFA and an onboarding and offboarding checklist |
| Incident register | Tickets in the existing support system, with a fixed reporting route |
Nobody works on security full-time. The CTO is the ISMS owner and spends a few hours a week on it. The rest is woven into existing processes.
Why an information security management system (ISO 27001)?
You can also do security without a system: a firewall here, a password policy there, the occasional security training. But that leads to:
- Gaps: you miss risks because nobody sees the full picture
- Inconsistency: one department is strict, another lax
- Ad-hoc responses: you fight fires instead of preventing them
- No improvement: without measurement, you do not know whether things are getting better
An ISMS brings structure. It forces you to look at risks systematically, plan measures, carry them out, check them and improve. This is the well-known Plan-Do-Check-Act (PDCA) cycle that sits at the centre of all ISO management systems.
The PDCA cycle in ISO 27001
The ISMS revolves around continual improvement through four phases.
Plan
In the planning phase, you decide what you are going to do:
- Analyse the context: who are your interested parties? What do they expect?
- Determine the scope: where does the ISMS apply?
- Assess risks: what could go wrong? How serious would that be?
- Select measures: which controls will you implement?
- Set objectives: what do you want to achieve?
Do
In the implementation phase, you put into practice what you planned:
- Implement measures
- Roll out procedures
- Train people
- Configure systems
- Write documentation
Check
In the checking phase, you verify whether it works:
- Monitor and measure: are we meeting our objectives?
- Internal audits: do we comply with the standard and our own policy?
- Management review: what does management think?
Act
In the improvement phase, you address shortcomings:
- Correct nonconformities
- Analyse causes
- Implement improvements
- Learn lessons and embed them
Then the cycle starts again. This is not a one-off exercise but an ongoing process.
The components of an ISO 27001 ISMS
A working ISMS consists of several parts that together form a whole.
1. Policy and procedures
You need documentation that describes how you approach information security:
- Information security policy: the overarching vision and principles
- Procedures: how you carry out specific processes (incident handling, access management, etc.)
- Work instructions: detailed steps for specific tasks
This does not have to be a thick handbook. Keep it practical. A wiki or SharePoint with up-to-date information often works better than PDFs that nobody reads.
2. Risk register
The risk register is the heart of your ISMS. It contains:
- Identified risks
- An assessment of likelihood and impact
- The chosen treatment (mitigate, accept, transfer, avoid)
- The person responsible for each risk
- The status of measures
Read more about risk assessment on the risk assessment page.
3. Statement of Applicability (SoA)
The Statement of Applicability, known in Dutch as the “Verklaring van Toepasselijkheid” (VvT), documents for each Annex A control whether you apply it and why. It is mandatory and unique to ISO 27001.
4. Records
Records are the evidence that your system works:
- Incident records
- Audit reports
- Minutes of the management review
- Training records
- Results of risk assessments
The auditor wants to see evidence. Without records, you cannot show that you do what you say you do.
5. Improvement records
You must keep track of which nonconformities you have found, which corrective actions you have taken and whether they were effective. This demonstrates continual improvement.
Setting up an ISO 27001 ISMS: practical steps
You build an ISMS step by step. The table gives the outline; the full route, with phases, tips and pitfalls, is in the step-by-step plan.
| Step | What you do |
|---|---|
| 1. Determine the scope | Do not start too broadly; document what falls under the ISMS |
| 2. Management commitment | Make management the owner, not just a sponsor |
| 3. Baseline measurement and gap analysis | Map what you already have and what is missing |
| 4. Risk assessment | The foundation: determine your risks before you choose measures |
| 5. Draft the SoA | Go through all 93 Annex A controls |
| 6. Implement measures | Prioritise by risk, start with quick wins |
| 7. Train people | Awareness that is relevant and repeated |
| 8. Run the system | At least 3 months operational to build evidence |
| 9. Internal audit | Have an independent person test your ISMS |
| 10. Management review | Management formally reviews the ISMS |
Keeping the ISO 27001 ISMS alive
After certification, the real work begins. An ISMS that gathers dust in a drawer is worthless. This is how you keep it alive:
Daily
- Record incidents
- Process access requests
- Assess changes
Weekly or monthly
- Security meeting
- Review vulnerabilities
- Awareness activities
Quarterly or yearly
- Update the risk register
- Internal audits
- Management review
- Review policies
When things change
- New systems or processes? Update your ISMS
- Reorganisation? Review roles and responsibilities
- New threat landscape? Reassess risks
Practical tip: integrate ISMS activities into existing processes. A security review in change management, a risk check in projects, awareness in onboarding. That way it becomes part of the culture, not an extra task.
Common mistakes with the ISO 27001 ISMS
Too much documentation
Some organisations think more paper is better. It is the other way round. An ISMS must be workable. A thin procedure that everyone knows is better than a thick handbook that nobody reads.
No ownership
If nobody feels responsible, nothing happens. Assign owners for risks, measures and processes.
A one-off exercise
Setting up an ISMS for the audit and then forgetting about it. You will then fail the next surveillance audit, and your certificate will be of no use to you.
IT only
Information security is not only an IT matter. HR, facilities, management and end users all play a role.
Copying templates
Downloading an ISMS from the internet and putting your name on it does not work. The auditor will see through it and, more importantly, it does not fit your organisation.
More information
- Requirements of the standard: all chapters explained
- Risk assessment: how do you carry out a risk assessment?
- Annex A: the 93 controls
- Glossary: all ISMS terms explained, from the CIA triad to the SoA
- Information security policy: the policy that describes the direction of the ISMS
- Step-by-step plan: from start to certificate
- The audit process: what can you expect?
- ISO 42001: the same principle, but for an AI management system (AIMS)