# What is an information security management system?

It is the set of policies, roles, processes and records through which an organisation manages information security on purpose rather than by accident. An information security management system (ISMS) answers a few questions continuously: what information and systems matter, which risks threaten them, which measures we take, who is responsible, how we know the measures work, and how we improve when they do not. Concretely it consists of documents such as a security policy, a risk assessment and a risk treatment plan, a statement of which controls apply, procedures for incidents and suppliers, plus evidence that they are followed: training records, access reviews, audit results and management review minutes. It is called a system because it runs in a cycle of plan, do, check and act. ISO/IEC 27001 defines its requirements, but even companies that never seek certification benefit from the structure, and NIS2 risk-management duties fit naturally into one. A monitoring tool is one control inside the system and a source of its evidence; it is not the system itself.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/what-is-an-isms

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)
- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)
- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)
- [Do we need ISO 27001 or SOC 2?](https://netsenx.com/en/faq/iso-27001-or-soc-2-which-do-we-need)
- [What is ISO/IEC 42001?](https://netsenx.com/en/faq/what-is-iso-42001)