Information security management system (ISMS)
An information security management system (ISMS) is the set of policies, processes, people and records an organisation uses to manage information security risk and to keep improving how it does so. ISO 27001 sets the requirements for one. A certificate covers the ISMS inside its written scope, not the whole company by default.
- Short form
- ISMS
- Clauses
- ISO 27001:2022 4.4 · ISO 27001:2022 4.3
Where the term appears
ISO 27001:2022 4.4 asks you to establish, implement, maintain and continually improve an ISMS, including the processes it needs and how they interact. ISO 27001:2022 4.3 sets its boundaries, and that scope is the one item in clause 4 the standard says you must document. Clauses 4 to 10 describe the system itself: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A is the reference list of 93 controls your risk treatment draws on. The ISO 27001 context page covers clause 4 in detail.
Controls are not the system
An auditor tests the management loop as well as the controls: risks assessed at planned intervals, internal audits held, a management review minuted, nonconformities closed. A company with well-run firewalls and no management review has controls, but not yet an ISMS.
How Sted uses it
- Sted treats ISO 27001 as applying when you already hold or pursue it or a customer requires it, when a law or scheme you are under (GDPR, PCI DSS, DORA, NIS2, UK FCA or PRA rules, or a high-risk AI system) makes a recognised security management system the expected way to comply, or when Sted’s benefit assessment recommends it; it is never a legal requirement in itself.
- For ISO 27001 Sted’s knowledge base carries 42 policies and procedures and 91 record templates tagged to its clauses and Annex A controls, and a Statement of Applicability over the 93 Annex A controls in four themes.
- Management-system registers (scope, interested parties, obligations, issues, objectives, risks and opportunities, processes) are edited by administrators; the first three are drafted from your onboarding answers and the rest start empty.
Related terms
- Statement of Applicability: the ISMS document that lists which controls apply.
- QMS: the quality counterpart, built on the same clause structure.
- Documented information: the documents and records an ISMS keeps.
- Interested parties: whose requirements shape the ISMS.
- Management review: where top management checks the ISMS still works.