ISMS Fundamentals and the ISO/IEC 27001 Standard
An information security management system (ISMS) is a systematic, risk-driven framework of policies, processes, roles, and controls used to protect the confidentiality, integrity, and availability (the CIA triad) of information. ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS. It is a management system standard, not a checklist of technical controls: it tells you how to govern security, while the control catalogue lives in ISO/IEC 27002 (guidance) and Annex A of 27001 (the reference control set).
Key concepts a candidate must own: the Plan-Do-Check-Act (PDCA) improvement cycle that underpins the standard; the process approach; the risk-based approach (controls are chosen because risk assessment justifies them, not because a list says so); the Annex A controls organised into themes (organisational, people, physical, technological); and the difference between requirements ("shall") and guidance ("should"). Understand the terms interested party, risk, risk treatment, statement of applicability (SoA), nonconformity, and continual improvement.
Traps to watch: confusing ISO/IEC 27001 (certifiable requirements) with ISO/IEC 27002 (non-certifiable guidance); assuming Annex A is mandatory in full (it is a reference set-you justify inclusions and exclusions in the SoA); and treating certification as proof of perfect security rather than conformity to a management system. Another common trap is thinking the standard prescribes specific technologies; it is deliberately technology-neutral.
Worked rule of thumb: if a question asks "what does ISO/IEC 27001 require?" the answer is a management process (assess risk, treat risk, measure, improve), not a specific firewall or encryption algorithm. If it asks "where are control details?" point to Annex A and 27002.
Remember: the ISMS is the system; certification confirms the system conforms to the standard.