Information security management system

Plain-language summary

The requirement to actually have a system — establish it, run it, maintain it and keep improving it — including the processes it is made of and how they interact, not a folder of policies.

What the clause is really asking

This is the clause that turns a documentation project into a management system. The 2022 edition added the words that matter: the ISMS includes the processes needed and their interactions. In practice that means risk assessment feeds treatment, treatment feeds the SoA and the controls, controls generate records and metrics, metrics feed audit and management review, and review feeds improvement and the next risk cycle — a loop that runs on a calendar, not a one-off exercise before the certification audit. Organisations that already hold ISO 9001 have most of the machinery (document control, audit, management review, corrective action); the clause invites you to extend that machinery to information security rather than build a parallel system. What auditors want to see is the system operating over time: dated records from several cycles, not a complete set created in the month before the audit.

What auditors look for

Auditors look for evidence of operation rather than existence. They ask for the process map or description of the ISMS and then follow one loop end to end: a risk raised, treated, controlled, measured, audited, reviewed. They look at dates — do risk reviews, audits, reviews and training recur at the planned intervals, or do all the records share one creation month? For integrated systems they check that the shared processes (audit, management review, document control) genuinely cover information security, with ISMS items on the agendas and in the audit programme, not just a QMS with the word 'security' inserted.

Typical evidence

ISMS manual or process description showing the processes and their interactions (a one-page PDCA diagram is enough); the annual ISMS calendar of planned activities; dated records from more than one cycle of risk review, internal audit and management review; where integrated with another management system, agendas and audit programmes that visibly include information security.

How to comply — recommendations

Draw the ISMS as a loop on one page — context and requirements, risk assessment and treatment, controls and operation, monitoring and audit, management review and improvement — with the owner and frequency of each box. Put it on an annual calendar and run it from day one, so that by the certification audit you have at least one full cycle of real, dated records. If you hold ISO 9001, extend the existing procedures rather than duplicate them: add information security criteria to the audit programme, ISMS inputs to the management review agenda and ISMS documents to the document register. Resist the template trap: a process you cannot show running is not a process.

Common nonconformities

ISMS exists as documents only, with no evidence of processes operating over time; processes and their interactions not identified; all records created in the weeks before the audit; integrated management system where audits and management review never actually address information security; no continual-improvement cycle visible.

Resources for this clause

• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.