The ISMS: purpose, benefits and the structure of ISO/IEC 27001
What an ISMS is
An information security management system is the set of interrelated policies, processes, roles and records by which an organisation preserves confidentiality, integrity and availability of information. ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving such a system; it does not mandate specific technologies.
Structure
Clauses 4–10 contain the auditable requirements: context (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). These follow the harmonised structure shared by other ISO management system standards, which is why integrated audits are feasible. Annex A contains 93 controls (2022 edition), grouped into organisational, people, physical and technological themes.
The risk-based engine
Clause 6.1 is the intellectual core: assess risk (6.1.2), treat it (6.1.3), and record the selected controls plus justifications in the Statement of Applicability. Annex A is therefore a reference catalogue, not a compliance checklist.
Benefits (and limits)
Certification gives demonstrable assurance to interested parties, supports legal and contractual compliance, and imposes disciplined governance. It does not certify that an organisation is 'secure' or that no incident will occur - only that its ISMS conforms to the requirements and is achieving intended results.
Traps
- 'The auditor must confirm all 93 controls are implemented.' False - only those in the SoA, and exclusions must be justified.
- Excluding controls must never remove the obligation to ensure confidentiality, integrity and availability.
- Confusing the management-system clauses with Annex A: findings are always against a requirement of the criteria.
Rule of thumb
For any clause, ask three questions: is it planned (documented intent), done (evidence of operation), and reviewed (monitoring, internal audit, management review, improvement)?