Information Security Management System (ISMS)
An ISMS is the management system that makes security repeatable: scope, leadership, risk-based planning, operation, performance evaluation and improvement. CISM tests ISO/IEC 27001 as the reference model and expects you to know which documents are mandatory, how certification works, and how the Statement of Applicability is used.
Core rules
- Clause structure. Context and scope (internal/external issues, interested parties) → leadership and policy → planning (risk assessment and treatment, objectives) → support (resources, competence, awareness, documented information) → operation → performance evaluation (monitoring, internal audit, management review) → improvement (nonconformity, corrective action).
- Mandatory documented information includes the ISMS scope, the information security policy, the risk assessment and treatment methodology, the risk treatment plan, the Statement of Applicability (SoA), audit results and management review outputs.
- Statement of Applicability. Lists every Annex A control with a status of applicable or excluded and a justification. Annex A:2022 contains 93 controls in four themes - organisational, people, physical, technological. Exclusion without justification is a finding.
- Certification cycle. Stage 1 is a readiness and documentation review; Stage 2 assesses implementation and effectiveness. Surveillance audits follow annually; recertification occurs every three years. Internal audit and management review must happen before the certification audit and at planned intervals thereafter.
- Improvement. Nonconformities are resolved through root-cause analysis and corrective action, not just a fix. Effectiveness of the ISMS is measured through objectives and metrics.
Worked example
A group wants certification but plans to exclude a recently acquired overseas subsidiary from scope. The examiner will look for: a documented scope statement naming the boundary, sites, systems and interfaces; the interfaces and dependencies to the excluded entity described and managed; outsourced processes identified; and a SoA whose exclusions are justified by risk, not convenience. Physically excluding a unit that shares the group's identity directory without addressing that interface is a scope error.
Traps that cost marks
- Confusing ISO/IEC 27001 (requirements, certifiable) with ISO/IEC 27002 (guidance, not certifiable).
- Treating Annex A as a checklist to implement wholesale rather than a catalogue filtered by risk assessment.
- Assuming management review is optional or delegable to the security team alone.
- Confusing internal audit (independent, first party) with the certification body's audit.