Information Security Management System (ISMS)

What is an Information Security Management System (ISMS)?

Safeguarding your organisation’s information assets

An Information Security Management System, or ISMS, does exactly what it says. It’s a comprehensive, practical system that helps you manage the security of your organisation’s information.

What does an ISMS do?

Safeguard your organisation’s information assets
Make it easy to show your customers and other stakeholders:
- How secure those information assets are
- How seriously your organisation takes infosec
Constantly evolve to keep up with:
- New infosec risks and opportunities
- Your organisation’s development and growth

Read our free guide to achieving ISO 27001 first time

Download now

What does an ISMS include?

To achieve ISO 27001 compliance or certification, you need a fully-functioning ISMS that meets the standard’s requirements. It will define your organisation’s information assets, then cover off all the:

Risks your organisation’s information assets face

Measures you’ve put in place to protect them

Guidance to follow or actions to take when they’re threatened

People responsible for or involved in every step of the infosec process

Shaping your ISMS

Your ISMS should meet your organisation’s unique needs, taking account of:

How your organisation, its stakeholders and customers work in practice
What sort of risk appetite you and they have
The wider contexts that affect you all

Most of our customers start with ISO 27001. An ISMS can also help you achieve other standards like GDPR and the NIST Cybersecurity Framework. Our platform supports those and many others. And it’ll accelerate you through everything we’ve listed above, and more.

The seven elements of an effective ISMS

Implementation resource

You’ll need a clearly defined manager or team with the time, budget and knowhow needed to make your ISMS happen. Our Assured Results Method will guide them all the way to first time ISO 27001 success.

Systems and tools

They’ll help you oversee your organisation’s software and hardware, its physical infrastructure and even its staff and suppliers. Our platform offers everything from our 24/7 Virtual Coach to a suite of implementation management tools.

Policies and controls

They’ll tell your colleagues, suppliers and other stakeholders how to protect your information assets and what to do when they’re at risk. Our pre-loaded Adopt, Adapt, Add Content takes you 77% of the way to creating yours.

Comms and engagement tools

Your colleagues need to know about and understand your ISMS, and have a clear sense of their responsibilities. Our Policy Packs help you share infosec guidance with everyone who needs to follow it.

Supply chain management tools

Your suppliers probably hold or handle valuable information on your behalf, so you need to make sure they comply with your ISMS too. Our Accounts feature helps you assess and respond to all your supply chain’s infosec needs.

Audit guidance and support

Whether you’re going for compliance or certification, your ISMS will need to successfully undergo ongoing audits. We can help you show your internal or external auditors how effective your ISMS is and achieve recertification too

Operation and improvement resources

Your ISMS will need to evolve with your organisation, meet constant new infosec challenges and stay glitch or error-free. We provide a full suite of ISMS management and improvement tools and guidance.

See our platform in action

Book your demo

fa-bolt

Safeguarding your customers

An effective ISMS doesn’t just protect you. It safeguards your customers too. The higher you move up the security scale, the more you’ll impress your current and potential ones.

No people system, policies or technology to support information or cyber security management

Minimum time spent on security related policies but not structured as a system or following any standards

Meeting the requirements for basic information security management e.g with Cyber Essentials

Investing in people, policies, processes and systems to show compliance with ISO 27001: 2013 and have an information security management system (ISMS)

Achieved and maintaining and independently certified ISMS that follows ISO 27001: 2013, underpinned with a sustainable technology solution

Our platform will accelerate your organisation to level four or five, with certainty. We can help you move beyond this scale too, as and when you need to.

We needed ISO 27001 to win new corporate clients and we needed it quickly. As a small business with limited resources, we were looking for a one-stop solution to radically speed up our implementation. ISMS.online has done exactly that.

Evan Harris

Co-founder

fa-bolt

Frequently Asked Questions

What is an Information Security Management System (ISMS)?

An Information Security Management System (ISMS) is a means of safeguarding important information, using a combination of processes, technology and people. An ISMS will help you protect and manage your organisation’s information through effective risk management. An ISMS also makes it easy to present to customers and interested parties how secure your information assets are while demonstrating to them how seriously you take your information security.

How does an ISMS protect information?

Having an ISMS complies with a variety of laws and regulations including GDPR (General Data Protection Regulation). An ISMS will focus on three key aspects of information.

Confidentiality: Information is not available or disclosed to people, entities or processes that are not authorised.
Integrity: Information is complete, accurate and protected from any corruption.
Availability: Information is accessible and can be used by authorised users.

What are the benefits of an ISMS?

An ISMS compliant with the ISO 27001 standard can do more than comply with laws and regulations such as GDPR. It can play a pivotal role in attracting new business and opportunities. An ISMS can also:

Secure all forms of information: Protect and manage your information whether it is paper-based, digital or stored on the cloud.
Keep up with information security risks and opportunities: An ISMS will increase the resilience of your organisation against cyber attacks.
Manage all of your information in one place: An ISMS provides a centralised point of contact with your organisation’s information where it is all safe and secure.
React to ever-evolving threats: An ISMS will reduce the threat of evolving risks that can affect your organisation internally or externally.
Protect your information’s confidentiality, availability and integrity: Your ISMS will have a set of policies, procedures and controls to protect the confidentiality, availability and integrity of your organisation’s information.
Make information security part of your organisation’s culture: Your ISMS will be about a whole lot more than IT. Help other members of your management and staff to understand risks and take on your organisation’s controls in their everyday work.

What makes up an effective ISMS?

There are seven elements that make an effective ISMS for your organisation:

Implementation resource: You will need a clearly defined manager or team with the time, budget and knowhow needed to make your ISMS happen.
Systems and tools: These will help you oversee your organisation’s software and hardware, its physical infrastructure as well as staff and suppliers.
Policies and controls: These tell your colleagues, suppliers and other interested parties how to protect your information assets and what to do when they’re at risk.
Comms and engagement tools: Your colleagues will need to know about and understand your ISMS and have a clear sense of their responsibilities as part of your organisation.
Supply chain management tools: Your suppliers probably hold or handle valuable information on your behalf, so it is important to make sure they comply with your ISMS too.
Audit guidance and support: Whether your organisation is going for compliance or certification, your ISMS will need to successfully undergo ongoing audits.
Operation and improvement resources: Your ISMS needs to evolve with your organisation, meet constant new infosec challenges and stay glitch or error-free.

How much does an ISMS cost?

The cost of your ISMS will vary with:

Your objectives
Your ISMS’ scope
The size and nature of your organisation
Your preferred ways of working
Quite a few other factors!

That’s why we only give quotes once we’ve found out who you are and what you need to achieve.

Why invest in an ISMS?

An effective ISMS will safeguard your organisation and help it grow. It can deliver a surprisingly high return on investment. Our “Building the Business Case for an ISMS” white paper shows you how to calculate your organisation’s ISMS RoI. More and more customers are looking for suppliers who take information security seriously. ISO 27001 compliance or certification is becoming a basic condition of entry. That’s because they understand just how damaging infosec incidents can be. On average, security breaches cost large organisations between £1.46m and £3.14m, and small ones between £75k and £311k. Under the EU GDPR regulations, organisations can face fines up to 4% of global turnover. The reputation hit can be very big too. That’s why an ISMS can be such a good investment. Building your first ISMS or upgrading your existing one will:

Give your customers and stakeholders infosec certainty
Safeguard your organisation’s brand, results and stakeholders
Help you win new business, enter new markets and grow

In the longer term, you’ll need to evolve your ISMS, maintaining your existing compliance or certification while possibly going for new standards. In general, we find our longer-term customers focus on:

Bringing down costs while increasing efficiency
Showing the real value of their work while reducing admin drudgery
Making it easy for users to understand and comply with their ISMS