Fundamental Concepts, Principles and Initiating an ISMS
What an ISMS is
An information security management system is the part of an organization's management system used to govern information security. ISO/IEC 27000 vocabulary defines information security as the preservation of confidentiality, integrity and availability (CIA); related principles worth naming in exam answers include authenticity, accountability, non-repudiation and reliability. An ISMS is a management system, driven by Plan–Do–Check–Act, not a document set, a firewall project, or a one-off risk report.
Core vocabulary
Risk is the effect of uncertainty on objectives, usually expressed as a combination of likelihood and consequence. Learn the chain asset → threat → vulnerability → likelihood → impact → risk, and the roles risk owner (accountable for managing a risk), risk acceptance criteria (thresholds set in advance) and residual risk (what remains after treatment).
Initiating the implementation
Initiation begins with top management's decision and continues through Clause 4: understanding external and internal issues (4.1), interested parties and their relevant requirements (4.2), defining the ISMS scope (4.3), and establishing the ISMS and its processes (4.4). Clause 5 then requires demonstrable leadership, an approved information security policy, and assigned roles, responsibilities and authorities - including who owns the ISMS and who owns risks.
Traps. Questions often imply ISO/IEC 27001 mandates a specific risk methodology or a particular tool. It does not: the organization defines criteria for performing risk assessments and for accepting risk, provided the process is consistent, repeatable and yields comparable results. Another trap is treating Annex A as a checklist every organization must fully implement regardless of risk. A third is confusing a vulnerability scan with a risk assessment.
Rule of thumb. If you cannot name the risk owner and the acceptance decision for a risk, it is not managed. For scope, document what the boundary includes (products, services, locations, interfaces, dependencies) and justify exclusions by showing the excluded part cannot affect the security of what remains.