ISO 27001 and the ISMS
Building a management system.
What ISO 27001 Is
ISO/IEC 27001 is the international standard for information security management. Unlike a flexible framework, it is a formal specification you can be certified against by an accredited body.
Its central concept is the ISMS, the Information Security Management System. ISO 27001 is less a list of technical controls and more a system for governing security as an ongoing, managed process.
The ISMS Concept
An ISMS is the set of policies, processes, roles, and controls an organization uses to manage information security risk systematically.
It is a management system, like a quality or environmental management system. The point is not a single audit pass but a living mechanism that:
- Assesses risk continuously.
- Applies and maintains controls.
- Measures effectiveness.
- Improves over time.