ISMS: understanding the information security management system

An ISMS (information security management system) is the organised set of policies, roles, processes and controls that allows an organisation to protect its information over time, starting from its risks. Its requirements are set by ISO/IEC 27001, the only standard in the ISO 27000 family that can be certified against. This guide explains what an ISMS is, how to implement it step by step, which documents it requires and how certification works.

A management system, not a technical project

The key word is management. An ISMS is not a firewall, a piece of software or a binder of procedures: it is a way of organising security so that it is decided, applied, checked and improved continuously. It answers three simple questions: what must be protected, and against what? Who does what to protect it? How do we know it works?

Its aim is to preserve the confidentiality, integrity and availability of information by applying a risk management process, and to give interested parties (customers, authorities, partners) confidence that risks are adequately managed. That is how ISO/IEC 27001 describes its purpose.

What an ISMS is not

• Not a security policy. The information security policy sets the rules; the ISMS is the system that keeps them alive.
• Not a certification. You can have an ISMS without certifying it; certification only attests that it meets the standard's requirements.
• Not a one-off project. An ISMS that is no longer reviewed or audited stops being one.

The current version is ISO/IEC 27001:2022, published in October 2022 and supplemented by a 2024 amendment requiring organisations to determine whether climate change is a relevant issue. Certificates issued against the old 2013 version had to be transitioned to the 2022 version by 31 October 2025, under the timeline set by the IAF (document MD 26). In 2026, a certified ISMS is therefore certified against the 2022 version.

Like all recent management system standards, ISO 27001 follows a common structure (the "harmonised structure"): clauses 1 to 3 are introductory, and the requirements sit in clauses 4 to 10.

The standard relies on other texts in the same family: ISO/IEC 27002:2022 details the security controls, ISO/IEC 27005:2022 guides risk management (see our article on ISO 27005), and ISO/IEC 27006-1 governs certification bodies.

To understand how the clauses fit together, people use the Deming wheel, or PDCA cycle: Plan, Do, Check, Act. The 2005 version of the standard presented it explicitly; since 2013, ISO 27001 no longer imposes it, but the logic is the same and it remains the best way to read an ISMS. Click on each phase:

Annex A of ISO 27001:2022 is a catalogue of 93 security controls, grouped into four themes (compared with 114 controls in 14 chapters in the 2013 version). Eleven controls are new and reflect changes in threats and practices: threat intelligence, cloud security, data leakage prevention, secure coding…

A key point that is often misunderstood: Annex A is not a list to apply wholesale. Controls are selected based on the risk assessment; Annex A is then used as a checklist to make sure no necessary control has been overlooked. The result is recorded in the Statement of Applicability (SoA), which states for each control whether it is included, why, and whether it is implemented. Exclusions must be justified: it is one of the first documents an auditor reads.

Implementing an ISMS follows a logical order derived from the standard's clauses. Here is a ten-step path, with the relevant clause, the expected output and the most common pitfall for each step:

How long does it take? It all depends on the scope, the starting maturity and the resources. One thing is certain: an ISMS must have been running for a while before the certification audit, because the auditor will check that internal audits, measurements and a management review have actually taken place. Several months is realistic, often more for a large organisation.

Who does what? The standard does not set an organisation chart, but requires roles to be assigned and communicated (clause 5.3). In practice, you almost always find top management committing and arbitrating, an ISMS manager (often the CISO) running the system, risk owners who approve treatment and accept residual risks, control owners in IT and business teams, and internal auditors independent of the activities they check. The DPO is involved as soon as personal data is in scope.

The heart of the work lies in steps 5 and 6: risk analysis. ISO 27001 does not impose a method, as long as it produces consistent, valid and comparable results. In France, many organisations use EBIOS Risk Manager, ANSSI's method, which can be run in a risk analysis tool, or ISO/IEC 27005.

ISO 27001 speaks of "documented information": some must be maintained (documents), some retained (records, in other words evidence). Here is what the standard explicitly requires:

On top of this come the documents required by the Annex A controls you select: topic-specific policies, asset inventory, operating procedures, continuity plan… The right reflex: document what is needed for the ISMS to work and be proven, no more.

Certification is issued by an accredited certification body; in France, accreditation is granted by Cofrac. The process runs as follows:

• Initial audit in two stages: the first checks the design of the ISMS and its documentation, the second checks on site that the system is actually applied.
• Certificate valid for three years, once any major nonconformities have been closed.
• Surveillance audits every year during the cycle, then a recertification audit.

Certification remains voluntary but is sometimes required. That is the case for HDS certification of health data hosts in France, whose framework is based on ISO 27001. Customers also very often ask for it, in tenders or supplier security questionnaires.

Beyond the certificate, a well-run ISMS brings concrete benefits:

• Clear priorities. Controls follow from the organisation's real risks, not from a generic list or the latest alert in the press.
• Involved management. The management review forces regular reporting on the state of security and arbitration, which makes it easier to obtain resources.
• Evidence on hand. The records required by the standard are the same ones customers, insurers and authorities ask for.
• A foundation for other requirements. NIS 2, DORA, HDS or your customers' contractual requirements rely on the same controls: the work done for the ISMS can be reused.
• A commercial advantage. ISO 27001 certification is a common language recognised internationally, which shortens security questionnaires and reassures in tenders.