Information security management system (ISMS)
What an ISMS is
An ISMS is a management system, not a policy folder. ISO/IEC 27001:2022 requires the organisation to establish, implement, maintain and continually improve it through Clauses 4-10: context, leadership, planning, support, operation, performance evaluation and improvement. The ISMS has a defined scope; a risk assessment and risk treatment process; a Statement of Applicability (SoA); and documented information to prove operation.
Core rules
- Clause 4 determines external and internal issues and interested parties; Clause 5 requires top management involvement, policy and roles.
- Clause 6 requires risk assessment, risk treatment, a risk treatment plan and the SoA. The SoA lists Annex A controls and justifies inclusion or exclusion.
- Annex A:2022 contains 93 controls in four themes: organisational, people, physical and technological. It is a reference set, not a checklist to apply blindly.
- Clause 9 requires monitoring, measurement, internal audit and management review; Clause 10 requires correction and continual improvement.
Worked example
An auditor finds a new cloud backup service in operation, but the risk assessment has not been updated and the SoA does not mention supplier or backup controls. The organisation says the service is low risk. The gap is not merely missing paperwork: Clause 6.1.2 risk assessment was not applied to a changed process, and the SoA under Clause 6.1.3 does not reflect controls. Evidence includes the service contract date, risk register version and SoA version. The finding is a nonconformity, not an observation.
Traps
Do not equate the ISMS with its documents. Do not demand every Annex A control. Do not accept a SoA that excludes a control without justification. Do not audit Clause 8 as a separate IT operations clause: it is where planned controls are actually run.