Control 4.4Information security management system
Establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of the standard.
Four verbs, and the standard means all four. “Establish” is the design; “implement” is operating it in the organisation rather than on paper; “maintain” is keeping it current as the context in 4.1 changes; “continually improve” is clause 10 and is not optional.
The phrase carrying the most weight is “and their interactions”. An ISMS is not a set of independent procedures: the risk assessment feeds the treatment plan, which feeds the Statement of Applicability, which feeds monitoring in 9.1 and audit in 9.2, and each of those feeds the management review. Where an organisation runs those as separate exercises owned by separate people, the system passes each clause individually and does not function as a system — which is what a certification auditor is ultimately judging.
How to put this in place
An ISMS is a set of connected processes, not a folder of policies. The project must decide how the pieces fit, who owns them and how they keep working after the project ends.
- Map the main processes: risk, controls, training, audit, review and improvement.
- Assign an owner to each and define how they hand work to each other.
- Document the ISMS in proportion to the organisation, for example a short manual with links.
- Set up a rhythm of reviews and records.
- Check that the processes run as written and fix those that do not.
Evidence an auditor usually looks for: an ISMS overview or manual, process owners, and records showing the processes running as described.
What is in the packs for this
ISO 27001 Implementation Methodology & Project PlanWord
Helps with this requirementin ISO 27001 Implementation & Certification Readiness
Covered in Phase 3 (Select and document controls) of the implementation plan, which sets out the work and the gate that closes the phase.