An information security management system, or ISMS, is the way an organisation decides what it must protect, how it will protect it, and how it will check that the protection works. ISO/IEC 27001 describes it as something you establish, implement, maintain and keep improving. The important word is keep. An ISMS is a habit, not a project with an end date.
The most common mistake is to treat it as a document exercise. Teams write policies, collect templates and fill a folder, then wonder why nothing changes. A folder of documents proves that people can write. It does not show that anyone decides, acts or checks differently on a Tuesday afternoon.
Start from scope and risk
Decide which parts of the business, which systems and which locations are inside the system, and why. Then assess risk against what matters to the business: customers’ data, uptime, regulatory exposure, reputation. Controls come after that, chosen because a risk calls for them. A list of controls with no risks behind it is a shopping list.
Give every control an owner
A control without a named person tends to be everyone’s job and therefore no one’s. Owners do not have to be security specialists. The person who runs onboarding owns the joiner checks. The person who manages suppliers owns supplier reviews. The security or GRC team supports, advises and checks.
Let records come from normal work
The best evidence is a by-product: the access review that was actually done, the ticket that shows a change was approved, the training record that exists because training happened. If evidence has to be created in a rush before an audit, the control is probably not operating.
Build in the review habit
ISO/IEC 27001 expects internal audits and management reviews for a reason. They are the moments where the organisation asks whether the system is working, whether risks have changed, and what to do next. Skipping them is the quickest way to turn a living system into a binder.
What auditors look for
An auditor wants to see that what you have written is what you do. They sample, ask people how things really work, and look for evidence that controls have operated over time, not just that a policy exists.
In one organisation, the information security policies were documented, access control procedures were approved, and audit evidence was neatly organised. However, periodic access reviews were not consistently performed, and employees who had changed roles still retained permissions they no longer needed. The ISMS looked complete during preparation, but the day-to-day controls told a different story. The turning point was assigning clear control owners, establishing scheduled reviews and making evidence part of normal operational activities.
If you take one thing from this: judge your ISMS by whether it changes decisions, not by how many documents it contains.
