Fundamental Principles and Concepts of an Information Security Management System (ISMS)
Purpose and building blocks
An Information Security Management System (ISMS) is the set of interrelated policies, objectives, processes and controls an organisation uses to preserve the confidentiality, integrity and availability (CIA) of information. Information is treated as an asset whatever its form - paper, database, conversation, cloud service.
Two ideas underpin everything else. First, risk-based thinking: information security risk is the effect of uncertainty on objectives, expressed through the likelihood of a threat exploiting a vulnerability combined with the resulting impact. Risk is owned by a named risk owner with authority to accept it. Second, risk treatment: the organisation compares assessed risk against its risk appetite / risk acceptance criteria and chooses to modify, retain, avoid or share it (the four options in ISO/IEC 27001:2022). Controls selected are recorded, with justification, in the Statement of Applicability (SoA).
The management system itself follows the process approach and continual improvement (Plan–Do–Check–Act): understand context and interested parties, secure leadership commitment, plan, operate, evaluate performance, improve.
Traps
- Confusing controls with treatment: treatment is the decision, controls implement it.
- Adding a fourth 'A' (authenticity, accountability) to the CIA triad - exam items expect three.
- Believing information security is owned by IT; ISO/IEC 27001 requires leadership commitment and organisation-wide responsibility.
- Treating the risk assessment as a one-off document rather than a repeatable process.
Rule of thumb
If no named risk owner exists for a risk, that risk is not being managed, whatever the spreadsheet says.