An ISMS (information security management system) is the way a business manages information security risk as an ongoing system. It covers the policies, processes, people and technical controls that decide what needs protecting, how it gets protected, and how you know it's working.
The key word is system. An ISMS isn't a product you install or a folder of policies you write once. It's a repeating cycle: work out your risks, deal with them, check that worked, and improve.
If you've landed here because a customer asked for ISO 27001, or a tender asked how you manage information security, this is what they're really asking about.
What's actually in an ISMS?
Every ISMS built to ISO 27001 has the same core pieces. In plain English:
| Piece | What it is | The question it answers |
|---|---|---|
| Scope | What parts of the business the ISMS covers | What are we protecting, and where are the edges? |
| Security policy | Leadership's stated intent and direction | What have the people in charge committed to? |
| Risk assessment | A repeatable way to find and rate security risks | What could go wrong, and how much would it hurt? |
| Risk treatment plan | What you'll do about each risk, and who owns it | Who's fixing what, and by when? |
| Statement of Applicability | Your position on each Annex A control: in or out, and why | Which controls apply to us, and can we justify that? |
| Internal audit | An independent check of whether the system works | Are we doing what we said we'd do? |
| Management review | Leadership regularly reviewing results and making decisions | Is anyone in charge actually paying attention? |
| Corrective actions | How problems get fixed at the root | When something breaks, does it stay fixed? |
The last three are what separate a working ISMS from a stack of documents. They're also the ones most often left until just before an audit, and it shows.
ISMS vs ISO 27001: what's the difference?
People use the two interchangeably, but they're different things:
- The ISMS is what you run inside your business.
- ISO/IEC 27001 is the international standard that says what a good ISMS must do. Certification is an independent auditor confirming yours meets it.
You can run an ISMS without ever getting certified. Plenty of businesses do this to get the discipline without the audit cost, then certify later when a customer asks for it. You can't go the other way, because there's nothing to certify without an ISMS behind it.
The current edition is ISO/IEC 27001:2022. Clauses 4 to 10 set out the management system requirements, and that's the ISMS itself. Annex A then lists 93 controls across four themes: organisational, people, physical and technological. You don't automatically have to implement all 93. You decide which apply based on your risks, and you justify your decisions in the Statement of Applicability.
ISMS vs Essential 8
The Essential 8 is a set of technical security controls published by the Australian Signals Directorate (ASD): things like multi-factor authentication, patching and backups. It tells you what to do to harden your systems.
An ISMS sits a level above that. It decides which risks matter, which controls you'll use, who's accountable, and how you'll prove it's all still working next year. It also covers ground the Essential 8 doesn't, such as suppliers, staff, physical security and incident handling.
The two fit together well. Essential 8 controls can sit inside an ISMS as part of how you treat your risks. If you're working through the Essential 8 at the moment, nothing is wasted. ASD has now published its successor, the Essentials series, and the same logic applies.
Does your business need one?
An ISMS usually starts to earn its keep when one of these is true:
- A customer contract or tender asks for ISO 27001 certification.
- Enterprise customers keep sending security questionnaires, and answering them takes real time every time.
- You hold sensitive customer, health or financial data, and "we think we're fine" isn't a good enough answer any more.
- You're selling overseas, where an international standard travels better than an Australian framework.
If none of those apply yet, you probably don't need a full ISMS today. Getting the technical basics right should come first, and our free Essential 8 self-assessment is a quick way to see where you stand.
How do you build one?
For a 20 to 100 person Australian business starting from scratch, this is the typical path:
- Gap assessment (weeks 1 to 2). Work out where you stand against the standard and what's missing.
- Design (months 1 to 3). Set the scope, write the policies, build the risk register and the Statement of Applicability.
- Implementation (months 4 to 8). Put the controls in place, train staff, and run the first internal audits so the system builds up a track record.
- Certification (months 9 to 12). Go through the Stage 1 and Stage 2 audits with a certification body.
That's 9 to 12 months in total. A business that already has some security controls in place can sometimes do it in 6 to 9.
Stage 1 is largely a check that your ISMS is designed properly and ready for audit. Stage 2 is the main event, where the auditor tests whether it actually operates the way your documents say. A certificate generally runs on a three-year cycle, with surveillance audits in between, so the system has to keep running after the certificate arrives.
Check that your certification body is accredited. In Australia and New Zealand, the accreditation body is JAS-ANZ. A certificate from an unaccredited body can leave you with a piece of paper your customers won't accept.
How to tell if an ISMS is real or just paperwork
I'm a certified ISO 27001 Lead Auditor, and this is the difference that matters. Here's what gives a paper ISMS away:
- The policies were downloaded, not decided. They describe a generic business and mention processes nobody here recognises.
- The risk register hasn't changed since it was written. A new system, supplier or office should show up in it. If the business has changed and the register hasn't, nobody is using it.
- The scope doesn't match the business. It leaves out the system customers actually care about, or claims more than you can evidence.
- There's no evidence the controls ran. "We review access quarterly" means little without records of the reviews.
- Management review is a signature, not a meeting. Leadership should be making real decisions from it, about risk, resourcing and what to fix.
- The tool is doing the thinking. Compliance software is useful for tracking evidence. It can't decide what your risks are, and an auditor will talk to your people, not your dashboard.
A good test: ask someone outside the IT team how a security decision gets made here. If they can roughly tell you, the ISMS is working.
Common questions
What does ISMS stand for?
ISMS stands for information security management system. It is the set of policies, processes, people and technical controls a business uses to manage information security risk on an ongoing basis.
Is an ISMS the same as ISO 27001?
No. An ISMS is the thing you run. ISO 27001 is the international standard that sets out what a good one must do, and it is what you get certified against. You can run an ISMS without being certified, but you cannot be certified without an ISMS.
Is an ISMS software?
No. Compliance software can help you track risks, evidence and audits, but buying a tool does not give you an ISMS. The ISMS is how your business actually makes and reviews security decisions.
How long does it take to set up an ISMS?
For a 20 to 100 person Australian business starting from scratch, expect 9 to 12 months from gap assessment to ISO 27001 certification. A business that already has some security controls in place can sometimes do it in 6 to 9 months.
Does a small business need an ISMS?
Not by default. It usually becomes worthwhile when customers, tenders or contracts start asking for ISO 27001 or detailed evidence of how you manage security. Below that point, a solid set of technical controls such as the Essential 8 is often the better first step.
Is an ISMS the same as the Essential 8?
No. The Essential 8 is a set of technical security controls. An ISMS is the management system around all of your security decisions, including which controls you use and why. They work well together, and Essential 8 controls can sit inside an ISMS.
Next steps
If a customer or tender is asking for ISO 27001, the most useful first step is finding out how far away you actually are. A gap analysis gives you that answer, plus a realistic plan and timeline.
Or see how we run ISO 27001 implementation, from gap assessment through to certification.
I'm Josh McCarthy, Director and Lead Auditor at Your IT Managers, an Australian managed IT and compliance firm that implements ISO 27001 and Essential 8 and runs managed IT for businesses across the country.