Information Security
Management System
or ISMS

What is Information Security Management System or ISMS?

Information Security Management System or ISMS is typically based on a common framework.  At CVG Strategy, our approach to Information Security is to use ISO 27001.  According to ISO/IEC 27001 Clause 3.7, an ISMS is that part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security.

History of ISMS and ISO 27001

BS 7799 – early ISMS

In the early 1990s the United Kingdom Department of Trade and Industry (DTI) supported the development of a standard for Information Technology and protection.  BS 7799 was a standard originally published by BSI Group in 1995.  It was written by the UK DTI, and consisted of several parts.

ISO / IEC 17799

The first part, containing the best practices for information security management, was revised in 1998; after a lengthy discussion in the worldwide standards bodies, it was eventually adopted by ISO as ISO/IEC 17799, “Information Technology – Code of practice for information security management.” in 2000.  ISO/IEC 17799 was then revised in June 2005 and finally incorporated in the ISO 27000 series of standards as ISO/IEC 27002 in July 2007.

The second part of BS7799 was first published by BSI in 1999, known as BS 7799 Part 2, titled “Information Security Management Systems – Specification with guidance for use.”  BS 7799-2 focused on how to implement an Information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-2.  This later became ISO/IEC 27001:2005. BS 7799 Part 2 was adopted by ISO as ISO/IEC 27001 in November 2005.

BS 7799 Part 3 was published in 2005, covering risk analysis and management.  It aligns with ISO/IEC 27001:2005.

Very little reference or use is made to any of the BS standards in connection with ISO/IEC 27001.

Information Security Management SystemInformation Security Management System Certification

An ISMS may be certified compliant with ISO/IEC 27001 by a number of Accredited Registrars worldwide.  Certification against any of the recognized national variants of ISO/IEC 27001 (e.g. JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself.

In some countries, the bodies that verify conformity of management systems to specified standards are called “certification bodies”, while in others they are commonly referred to as “registration bodies”, “assessment and registration bodies”, “certification/ registration bodies”, and sometimes “registrars”.

The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage external audit process defined by the ISO/IEC 17021 and ISO/IEC 27006 standards:

ISMS Stage 1

A preliminary, informal review of the ISMS, for example checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP).  This stage serves to familiarize the auditors with the organization and vice versa.

ISMS Stage 2

A more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001.  The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors.  Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.

ISMS Surveillance

Ongoing involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.

How Can We Help?

Take a look around our site and contact us for more information on how we can help you meet your challenges.

Latest News