What is an Information Security Management System (ISMS)?
Safeguarding your organisation’s information assets
An Information Security Management System, or ISMS, does exactly what it says. It’s a comprehensive, practical system that helps you manage the security of your organisation’s information. An effective ISMS will:
- Safeguard your organisation’s information assets
- Make it easy to show your customers and other stakeholders:
- How secure those information assets are
- How seriously your organisation takes infosec
- Constantly evolve to keep up with:
- New infosec risks and opportunities
- Your organisation’s development and growth
To achieve ISO 27001 compliance or certification, you need a fully-functioning ISMS that meets the standard’s requirements. It will define your organisation’s information assets, then cover off all the:
- Risks your organisation’s information assets face
- Measures you’ve put in place to protect them
- Guidance to follow or actions to take when they’re threatened
- People responsible for or involved in every step of the infosec process
It should also meet your organisation’s unique needs, taking account of:
- How your organisation, its stakeholders and customers work in practice
- What sort of risk appetite you and they have
- The wider contexts that affect you all
Most of our customers start with ISO 27001. An ISMS can also help you achieve other standards like GDPR and the NIST Cybersecurity Framework. Our platform supports those and many others. And it’ll accelerate you through everything we’ve listed above, and more.
The seven elements of an effective ISMS
1. ISMS implementation resource
Creating or upgrading an ISMS can be a complex, challenging process. To navigate it successfully, you’ll need a clearly defined manager or team with the time, budget and knowhow needed to make your ISMS happen.
Our Assured Results Method guides you all the way to first time ISO 27001 compliance or certification success. And it’s easy to migrate work you’ve already done into our platform.
2. Systems and tools for implementation and ongoing management
An effective ISMS draws on and manages many different resources. They can include your organisation’s software and hardware, its physical infrastructure and even its staff and suppliers. You’ll need the right systems and tools to guide and oversee them all.
Our platform includes a wide range of bespoke support systems, ranging from our context-specific Virtual Coach to a full suite of implementation management tools.
3. Actionable policies and controls that will work in practice
Your ISMS will tell your colleagues, suppliers and other stakeholders how to protect your information assets and what to do when they’re at risk. That needs to be defined in clear, widely understood and easy to act on policies and controls.
Our pre-loaded Adopt, Adapt, Add Content gives you actionable policies and controls that take you 77% of the way to before you’ve even begun.
4. Staff communications and engagement mechanisms
Your organisation needs to live and breathe your ISMS. So your colleagues need to know about it, understand why it’s so important and have a clear sense of their infosec responsibilities. If it just sits there gathering dust, it won’t protect anything!
Our Policy Packs make it easy to share specific policies and controls with everyone who needs to know about and follow them, across your organisation and beyond it.
5. Systems and tools for supply chain management
Your ISMS will extend beyond your organisation. Your suppliers probably hold or handle valuable information on your behalf, so you need to make sure they comply with it too. And you’ll need to protect yourself against any issues or challenges they could create.
Our Accounts feature gives you everything you need to assess your supply chain infosec needs, then put the right precautions in place to meet them.
6. Certification activity and working with external auditors
If you’re going for full ISO 27001 certification, you’ll need to find a properly-accredited independent certification body. They’ll take you through a two-stage certification process. Then they’ll return for regular update audits during the three-year life of your certification.
We can guide you all the way to ISO 27001 certification, make showing your auditors how effective your ISMS is a simple task and help you achieve recertification too.
7. Ongoing ISMS operation and improvement resource
An effective ISMS is always on and always alert. It evolves to match its organisation’s growth and development, and meet constant new infosec challenges. And it quickly picks up and corrects any of its own glitches or errors.
We provide a full suite of ISMS management and improvement tools, plus guidance on everything from involving your senior management to reporting ISMS issues.
Safeguarding your customers
An effective ISMS doesn’t just protect you. It safeguards your customers too. The higher you move up the security scale, the more you’ll impress your current and potential ones.
Our platform will accelerate your organisation to level four or five, with certainty. We can help you move beyond this scale too, as and when you need to.
- Your objectives
- Your ISMS’ scope
- The size and nature of your organisation
- Your preferred ways of working
- Quite a few other factors!
That’s why we only give quotes once we’ve found out who you are and what you need to achieve.
An effective ISMS will safeguard your organisation and help it grow. It can deliver a surprisingly high return on investment. Our “Building the Business Case for an ISMS” white paper shows you how to calculate your organisation’s ISMS RoI.
More and more customers are looking for suppliers who take information security seriously. ISO 27001 compliance or certification is becoming a basic condition of entry. That’s because they understand just how damaging infosec incidents can be.
On average, security breaches cost large organisations between £1.46m and £3.14m, and small ones between £75k and £311k. Under the EU GDPR regulations, organisations can face fines up to 4% of global turnover. The reputation hit can be very big too.
That’s why an ISMS can be such a good investment. Building your first ISMS or upgrading your existing one will:
- Give your customers and stakeholders infosec certainty
- Safeguard your organisation’s brand, results and stakeholders
- Help you win new business, enter new markets and grow
In the longer term, you’ll need to evolve your ISMS, maintaining your existing compliance or certification while possibly going for new standards. In general, we find our longer-term customers focus on:
- Bringing down costs while increasing efficiency
- Showing the real value of their work while reducing admin drudgery
- Making it easy for users to understand and comply with their ISMS