If you are pursuing ISO 27001 certification, you will hear one term constantly: ISMS—an information security management system. It is the management framework auditors evaluate—not a single tool or policy folder.

This guide explains what an ISMS is, what it must include for ISO 27001, and how it connects to Annex A security controls.

Related guides:

Key takeaways

An ISMS is a repeatable system for managing information security risk—not a one-time checklist.
ISO 27001 clauses 4–10 define how you run the ISMS; Annex A lists controls you may apply based on risk.
Certification proves your ISMS is designed and operating effectively through independent audit.
Strong ISMS programs emphasize scope, risk treatment, evidence, and continual improvement.

What is an ISMS?

An information security management system is the combination of:

Governance (leadership, roles, policies)
Risk management (assessment, treatment, acceptance)
Operational controls (technical and procedural safeguards)
Monitoring and improvement (metrics, internal audit, corrective actions)

The goal is to protect confidentiality, integrity, and availability of information in a way that scales with your business.

Core components of an ISMS

Component	What it typically includes
Scope	Systems, locations, teams, and data in scope
Policies	Information security policy and topic-specific policies
Risk process	Risk assessment, treatment plan, SoA
Controls	Annex A controls selected for your risks
Evidence	Logs, tickets, reviews, training records
Review cycle	Internal audits, management review, surveillance audits

ISO 27001 clauses vs. Annex A controls

Clauses 4–10 (management system): context, leadership, planning, support, operation, performance evaluation, improvement.
Annex A (control catalog): 93 controls in ISO 27001:2022, grouped into organizational, people, physical, and technological themes.

You implement both: the ISMS process and the controls you declare applicable in your Statement of Applicability (SoA).

How to build an ISMS (high level)

Define scope and interested parties.
Perform a risk assessment and create a risk treatment plan.
Select Annex A controls and document your SoA.
Implement controls and collect evidence.
Run an internal audit and management review.
Engage a certification body for Stage 1 and Stage 2 audits.

See certification roadmap.

Operate your ISMS with SecureSlate

SecureSlate connects policies, controls, risks, and evidence in one place—so your ISMS stays current between audits.

Get started for free

FAQ

Is an ISMS the same as a GRC platform?
No. A GRC platform can support an ISMS; the ISMS is your program design and operating rhythm.

Do we need every Annex A control?
No. You apply controls based on risk and document decisions in the SoA.

Disclaimer (legal note)

This article is general information only, not legal or certification advice. Requirements vary by scope and auditor interpretation.

What is an information security management system (ISMS)? A practical explainer