What is an Information Security Management System (ISMS)?

An ISMS is a systematic approach to managing sensitive information so that it remains secure. Under ISO 27001, an ISMS includes policies, processes, organizational structures, and tools for managing information security risks. It is defined by the organization's scope, security objectives, risk assessment methodology, risk treatment plan, and applicable controls from Annex A.