Information Security Management: the ISMS, risk-driven control selection and continual improvement
Information security management is the spine of the EXIN ISMP syllabus. Questions in this domain test whether you understand an ISMS as a management system - not a pile of technical controls - and whether you can apply ISO/IEC 27001's mandatory clauses, risk-driven control selection and continual-improvement loop to a realistic scenario.
What "management system" means
- Clauses 4–10 are mandatory: context of the organization, leadership, planning, support, operation, performance evaluation, improvement. Annex A is subordinate to them.
- The Statement of Applicability (SoA) lists every Annex A control with an include/exclude decision and a justification for each.
- Required documented information includes the scope, information security policy, risk assessment and treatment process, SoA, risk treatment plan, competence evidence, audit results, management review output and nonconformity records.
- ISO/IEC 27001:2022 Annex A contains 93 controls in four themes (organizational, people, physical, technological); the 2013 edition had 114 controls in 14 domains. Check which edition your syllabus cites.
Risk drives everything
Risk assessment identifies assets, threats, vulnerabilities, likelihood and impact, and evaluates them against acceptance criteria owned by the risk owners. Treatment options are modify, retain, avoid and share. Controls may be drawn from Annex A or from anywhere else - the standard does not restrict you to Annex A.
The improvement loop
Plan (scope, policy, risk assessment, SoA) → Do (implement, train, operate) → Check (monitoring, internal audit, management review) → Act (correction, corrective action, improvement).
Worked example
A 40-person SaaS company scopes its ISMS around the production platform and excludes the outsourced marketing site, justified in the scope statement because that site holds no customer data. Its risk assessment rates "admin console without MFA" as high. Treatment: enforce MFA, referenced to Annex A 8.5 (secure authentication). The SoA marks the control applicable with that reference. Internal audit later finds two legacy accounts outside MFA - a nonconformity. The team fixes the accounts (correction), investigates why onboarding missed them (root cause), updates the joiner checklist (corrective action) and verifies effectiveness at the next management review. Reasoning: the risk selects the control, the SoA records the decision, audit and corrective action close the loop.
Traps that cost marks
- Confusing the SoA (which controls, and why) with the risk treatment plan (actions, owners, deadlines).
- Believing every Annex A control must be implemented: all must be considered, and exclusions must be justified.
- Confusing internal audit (independent check) with management review (top management's evaluation).
- Treating risk assessment as a one-off project instead of a repeating cycle.
- Answering "correction" when the question asks for "corrective action".