Information security management system

What the requirement asks

The organization must set up, put into operation, keep up and keep improving an ISMS, including the processes it needs and how those processes interact, in line with what this standard requires.

What the guidance adds

The management system is the set of processes and their interactions, not the document set. The guidance asks for a process map with inputs, outputs, owners and sequence, and for evidence that the processes are actually operated together. A folder of procedures that no one follows does not satisfy this clause.

What good looks like

Keep an ISMS manual or process map showing the ISMS processes and how they interact with the clause record, and give it an owner and a review date.

Evidence an assessor asks for

• ISMS establishmentAn ISMS manual or process map showing the ISMS processes and how they interact
• ISMS establishmentEvidence each process required by Clauses 4 to 10 is defined and operating
• ISMS establishmentRecords demonstrating maintenance and improvement over time, such as updated procedures and closed improvement actions
• ISMS establishmentOwnership assigned for each ISMS process

The question an assessor will ask

An assessor will ask for an ISMS manual or process map showing the ISMS processes and how they interact. The test for 4.4 is whether that record can be produced for a live sample, not whether the clause is described in a procedure.

Common gaps

• The ISMS exists as documents that do not describe how processes connect
• Some required processes, such as planning of changes, are missing
• No evidence of improvement between certification cycles
• Process owners are not named

Before the next audit

Before the next audit, test this against one live record: the isms exists as documents that do not describe how processes connect.