ISMS means information security management system. It is a risk-based way of managing information so that it stays confidential, accurate and available, and it is audited by testing whether the company's own risk decisions and controls are actually in place and working. ISO/IEC 27001 is the standard most companies use to build one.
Last reviewed: 17 October 2026. Facts checked. We searched for ISMS and ISO 27001 certification material and opened the Wikipedia page on ISO/IEC 27001. A Kiwa page and other certification guides were returned by the search, but the Kiwa page we tried returned an error and we did not open it. The standard is a paid document and we have not read its text. Control counts and edition years below come from Wikipedia only.
What an ISMS is, in plain words
An ISMS is not a list of security tools. It is a management system. The company works out what information it holds, what could go wrong, and how much risk it will accept. Then it chooses controls, runs them, checks them and improves them.
The Wikipedia page we read describes it as a risk-based framework for keeping information confidential, intact and available. The key word is risk. Two companies can have different controls and both be right, because their risks differ.
ISO/IEC 27001 in brief
The page lists these editions: first published in October 2005, revised in 2013 and again in October 2022. The 2022 edition was amended in February 2024 with climate action changes, which add a requirement to decide whether climate change is relevant to the company's context. The page also says accredited certification bodies had until 31 October 2025 to move certified clients to the 2022 edition.
The requirements sit in clauses 4 to 10:
| Clause | Plain meaning |
|---|---|
| 4. Context | Understand the company, its stakeholders and the ISMS scope |
| 5. Leadership | Top management commits, sets a policy and assigns roles |
| 6. Planning | Assess and treat risks, set objectives |
| 7. Support | Resources, skills, awareness, documented information |
| 8. Operation | Carry out the planned risk work |
| 9. Performance evaluation | Monitor, run internal audits, hold management review |
| 10. Improvement | Fix nonconformities and keep improving |
Annex A is a reference set of 93 controls in four themes: organisational, people, physical and technological. It is not a mandatory checklist. The company picks the controls its risks need and records its reasons in a Statement of Applicability. ISO/IEC 27002 gives guidance on the controls.
How an ISMS is audited
Three audits matter.
- Internal audit. The company checks its own ISMS at planned intervals. Our ISO 27001:2022 internal audit guide walks through it.
- Certification audit. An independent certification body audits the ISMS. ISO does not certify companies. Per Wikipedia, Stage 1 is a readiness review of documents and scope. Stage 2 tests whether the ISMS is implemented and operating. The audit team recommends, and the certification body decides.
- Surveillance and recertification. The page says the first surveillance audit takes place within 12 months of certification and then yearly. Recertification is normally needed every three years. See the certification cycle explained.
Certification covers only the scope on the certificate. It does not mean no incident will happen. Residual risk is accepted by risk owners.
What auditors look for
- Scope. Does it match how the business really runs? A narrow scope can hide the risky parts.
- Risk assessment. Is there a method, applied consistently, with owners for each risk?
- Statement of Applicability. Does it list every Annex A control as in or out, with a reason? Do the "in" controls exist?
- Evidence of operation. Access reviews, backup tests, incident logs, supplier checks. Auditors ask for the record, not the policy.
- Internal audit and management review. Both must have happened, with records.
- Corrective action. Findings are fixed at the cause.
Common mistakes
- Copying a template Statement of Applicability without checking each control.
- Treating the ISMS as an IT project. Leadership and HR are part of it.
- Writing policies that nobody follows.
- Running internal audits only just before the certification audit.
Related standards
ISMS is often compared with SOC 2. They are different. See ISO 27001 vs SOC 2. For readiness, try the ISO management system readiness scorecard.
Frequently Asked Questions
What does ISMS stand for?
Information security management system.
Is ISMS the same as ISO 27001?
No. The ISMS is the system. ISO 27001 is the standard that sets requirements for it.
Do all 93 Annex A controls have to be used?
No. The company selects the controls its risks require and explains inclusions and exclusions in the Statement of Applicability. Check the standard text for the exact rule.
Is ISO 27001 certification mandatory?
Not by itself. Per Wikipedia, certification is optional unless a law, contract or scheme requires it. Check your contracts.
Who can audit an ISMS?
Internal auditors who are impartial and competent can audit it for the company. Certification must come from an independent certification body.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error