Information security management system (ISMS)

The set of policies, processes, roles and controls through which an organisation manages information security risk as a continuing activity, not a one-off project. ISO/IEC 27001 is the standard an ISMS is certified against: clauses 4 to 10 set the management requirements and Annex A lists the reference controls. A certificate means an accredited body has audited the system; it does not mean the company cannot be breached.