What an ISMS is
An information security management system, or ISMS, is the set of policies, processes, roles, and controls through which an organization decides what information needs protecting, from what, and how, and then checks that the decisions hold. The word to notice is management. An ISMS is not a product you install but a way of running data security as an ongoing responsibility, with owners, records, and regular reviews.
The international reference is the ISO/IEC 27000 family. ISO/IEC 27001 sets the requirements an ISMS must meet and is the standard organizations are certified against, while ISO/IEC 27002 is a catalog of security controls with implementation guidance. The goal is to protect the confidentiality, integrity and availability of information in any form: files, databases, paper, even conversations.
Because an ISMS is risk-based, two companies can satisfy the same standard with very different sets of controls. What the standard asks for is not a fixed shopping list but evidence that risks were identified, treated on purpose, and revisited.
How an ISMS runs
An ISMS works as a loop, often described with the Plan-Do-Check-Act model, not as a one-off project. Everything starts from knowing what you have: an up-to-date IT asset register and a working data classification scheme show where controls are worth their cost. The usual order of the cycle is this:
- 1
Set the scope
Define which units, locations, systems, and data the ISMS covers, and who has a stake in it: customers, regulators, staff.
- 2
Assess and treat risk
Identify assets and threats, rate the risks, and decide to reduce, avoid, share or accept each one. Every risk gets an owner and a recorded decision.
- 3
Select and run controls
Choose controls that match the risks, record the choice and its reasons in the Statement of Applicability, and put the controls into daily operation.
- 4
Measure and audit
Track how controls perform, run internal audits, and hold management reviews, so leaders see results and not only policies.
- 5
Improve
Fix nonconformities, learn from incidents, and feed the findings into the next risk assessment.
What an ISMS contains
The standard asks for documented information, but documents alone do not make an ISMS. Most of the elements below exist to show that the management cycle really turns:
| Element | What it is | What an auditor asks to see |
|---|---|---|
| Scope statement | The boundary of the ISMS: units, sites, systems | A written scope that matches reality |
| Security policy | Top management's stated direction and objectives | A policy approved and communicated by leadership |
| Risk assessment and treatment | The method for finding, rating, and handling risks | A risk register with owners and decisions |
| Statement of Applicability | The list of chosen controls, with reasons for each inclusion or omission | A justification for every omission |
| Operational controls | Access, devices, logging, backups, supplier checks | Records that controls work in practice |
| Internal audit and review | Planned checks and leadership reviews | Audit reports, minutes, and follow-up actions |
What it looks like in Anexet
An ISMS needs evidence that controls exist and that changes to them can be traced. In Anexet Inventory, a workstation card lists installed programs with version and install date, which is the raw material for an asset register. In the Administrator console, the Journal tab records who changed which profile or rule, and when.
1 / 2
Who does what
A common surprise for first-time implementers is how little of an ISMS belongs to the security team. The standard expects leadership to take part, and risk owners to be the people who actually own the business process. In practice the roles look like this:
| Role | Owns | Typical decision |
|---|---|---|
| Top managementExecutives and board | Policy, resources, objectives | Approves the policy and the acceptable level of risk |
| ISMS managerSecurity or compliance lead | Day-to-day running of the system | Coordinates risk work, reporting, and audits |
| Risk ownerBusiness or process owner | One specific risk | Accepts or rejects the proposed treatment |
| Control ownerIT, HR, facilities | One specific control | Operates the control and keeps its records |
| Internal auditorIndependent of the work audited | Assurance | Checks that practice matches policy and reports gaps |
ISMS, ISO 27001 and other frameworks
ISO/IEC 27001 is often confused with the ISMS itself. The ISMS is what the organization runs, the standard is the yardstick, and certification is an independent audit of that system within a stated scope. A certificate therefore says the scoped system meets the standard. It does not say the whole company is secure or that a breach cannot happen.
Other frameworks sit alongside. The NIST Cybersecurity Framework and NIST SP 800-53 supply structures and control catalogs, SOC 2 is an auditor's attestation report against criteria for service organizations, and laws such as the GDPR and the EU's NIS2 Directive require appropriate security measures without prescribing an ISMS. A working ISMS makes this overlap cheaper, because one risk process and one body of evidence feed several requirements through compliance management. It helps demonstrate diligence, but it does not equal legal compliance on its own.
Common mistakes
Most ISMS programs stall for organizational reasons, not technical ones. A typical sequence is to buy a tool, such as a DLP system, before anyone has listed what must be protected, and to write the paperwork afterwards. The patterns repeat:
An ISMS that exists only on paper passes the audit and fails the incident.
- A scope drawn so narrow that the certificate covers little of what customers care about
- A risk register copied from a template, with no real owners
- A Statement of Applicability full of “not applicable” with no reasons
- Policies written once, never read and never tested
- Audit findings closed on paper without removing the cause
Where to start
Start small and real: pick a scope that matters to customers, list its information assets and their owners, and rate the few risks that would hurt most. Controls come after that, in order of risk, not in the order of the standard's table of contents.
Let the systems produce the evidence, for example, scheduled security reports and change logs, instead of assembling screenshots the week before an audit. An ISMS that is cheap to keep running is the one that survives its second year.
A policy shows what you intend. A log shows what happened. An ISMS is the habit of comparing the two.
Anexet TeamHow Anexet handles this
Anexet is not an ISMS and does not certify anyone: an ISMS is a management system, and the standard is met through the organization's own processes. What Anexet provides is technical controls and records that such a system can draw on.
Anexet is deployed on-premise, so captured data, reports, and the audit trail stay inside the organization's infrastructure, which matters when the ISMS scope includes sensitive information.
Asset visibility
Agents report installed software and connected devices for every workstation, which supports an up-to-date asset register.
Data and device controls
Blocking rules and device rules allow or deny transfers and USB storage, down to a device class or serial number.
Risk categories
Built-in categories such as Data leak, Law violation, and Internal Threat carry default risk levels, and custom categories can be added.
Audit trail
The Journal records administrator actions, such as profile changes and blocking rule creation, with timestamps.
Security reports
Learn more