What is an ISMS?

ISMS in plain English

Many companies have a firewall, antivirus software, and backups. Yet often nobody knows exactly whether these measures are sufficient, who is responsible for them, and when they were last reviewed. This is exactly where an information security management system comes in.

An ISMS isn’t a program you install or a device you buy. It’s a management system – comparable to quality management in manufacturing. There, defined processes ensure that products are reliably good. In the same way, an ISMS ensures that information is reliably protected: against unauthorized access (confidentiality), against tampering (integrity), and against outages (availability).

And it’s not just about technology. An ISMS also covers paper files, processes, contracts with service providers, and employee behavior. Responsibility lies with senior management.

How an ISMS works

An ISMS follows a cycle often called the PDCA cycle, short for its four steps – Plan, Do, Check, Act:

1. Plan: Management defines which areas the ISMS covers and adopts a security policy – a foundational document that sets out the objectives and ground rules. Then risks are identified and assessed: What could happen, how likely is it, and how great would the damage be?
2. Do (implement): Suitable measures are introduced – technical ones such as access rights and encryption as well as organizational ones such as training or an emergency plan.
3. Check (review): Internal audits – planned self-assessments – and technical tests show whether the measures actually work. These include vulnerability scans, i.e., automated searches for known security gaps, and penetration tests, in which experts simulate an attack.
4. Act (improve): Identified gaps are closed, and the lessons learned feed into the next planning round.

There are also fixed roles. Usually, a designated person – the information security officer – coordinates the ISMS and reports directly to senior management.

Recognized standards serve as the foundation: internationally, ISO/IEC 27001, and in Germany, also the IT-Grundschutz methodology of the BSI (Germany’s Federal Office for Information Security). The BSI is currently transitioning IT-Grundschutz step by step to “Grundschutz++”; the existing IT-Grundschutz remains usable during a transition period of several years. In the automotive industry, TISAX assesses suppliers’ information security against an industry-specific catalog.

A practical example

Here’s a typical scenario: An engineering firm with 80 employees has to show a major client how it protects confidential design data. Until now, the IT administrators have been handling security on the side. Management decides to build an ISMS based on ISO/IEC 27001. A small team first takes stock of all important information and systems and assesses the risks. In the process, it turns out that former employees still have access to the project file share and that the backups have never been tested. Both issues are fixed. A penetration test also checks the remote access points. From now on, every further review provides input for the next round of improvements.

Why does this matter for businesses?

Without an ISMS, security remains patchwork: individual measures exist, but nobody has the full picture. Gaps often only come to light after something has happened. An ISMS makes risks visible and decisions traceable – including to customers, insurers, and authorities.

Requirements are also increasing. The NIS2 Directive obliges companies within its scope to implement systematic risk management, for which senior management is responsible. An ISMS is the usual way to meet such obligations in a structured manner. Article 32 of the GDPR likewise requires appropriate technical and organizational measures and regular reviews of them.

What businesses should do now

• Clarify responsibility: Appoint a person responsible for information security, and give them time and backing.
• Start small: Begin with the areas that matter most to your business instead of including everything right away.
• Choose a standard: Decide whether ISO/IEC 27001, IT-Grundschutz, or an industry standard such as TISAX best fits your customers and obligations.
• Assess risks: Determine which information and systems are critical and what threatens them.
• Document measures: Record who implements what and by when.
• Review effectiveness regularly: Schedule internal audits, vulnerability scans, and penetration tests as fixed items – not just shortly before an audit.

How Rootsektor can help

An ISMS is only as good as the information it’s built on. With penetration tests and security assessments, Rootsektor provides reliable facts about the actual state of your IT – presented clearly for senior management and with concrete measures for your technical team. You’ll find an overview of our assessments, reviews, and simulations under Security Services; for regular technical checks, a vulnerability assessment, for example, is a good fit. The test certificate you receive on completion of a test serves as evidence in your ISMS.