Implementing an Information Security Management System
By: Author
An information security management system (ISMS) is a formal, controlled set of processes and procedures dealing with the management of information security within an organization. The implementation of an ISMS is a key step that any organization in possession of valuable information assets should consider. This article offers an overview of the implementation process, and explains the benefits of an ISMS.
1Why implement an ISMS?
An ISMS offers a number of significant benefits to both the organization and its customers.
a. It ensures suitable security controls are in place: The intensive risk assessment and other processes involved in implementing the ISMS help to verify that any security controls and strategies are appropriate, cost effective, and prioritized to address the core security needs of the organization.
b. It demonstrates a commitment to security best practice: The existence of an ISMS is a powerful demonstration to an organization's customers of its commitment to information security. Customers can be confident that an ISMS-compliant organization understands and implements industry best practice. Certification of the ISMS provides independent and unbiased evidence of this compliance.
c. It ensures compliance with third party obligations: Many organizations will have external responsibilities with regard to the data in their possession. These may concern privacy, intellectual data ownership, or, in an increasingly regulatory environment, legal issues. An ISMS can greatly assist an organization in the fulfillment of such requirements.
2 Planning your ISMS
The thoroughness of the planning phase is vital to the ultimate effectiveness of the ISMS itself. A realistic and detailed plan should be prepared and agreed to, against which performance should be measured at every step of the implementation. This will ensure the process remains on track and that the ISMS ultimately