Information Security Management System (ISMS)
The set of policies, processes, and controls through which an organisation manages information security. The core of ISO 27001.
An ISMS is not a folder of documents; it is a living mechanism. Risk drives the selection of controls, controls have owners and evidence, and the whole system operates within a cycle of continual improvement (PDCA). ISO 27001 is the standard on which the ISMS is built and certified.
The components of an ISMS include: scope definition, information security policies, risk assessment, Statement of Applicability (SoA), incident management, business continuity, and internal audits.
The key is coherence. When a policy, a risk entry, and its supporting evidence live in separate files, the system drifts apart within months. When they share a common data layer, an audit stops being a last-minute evidence-gathering exercise.
In practice: see the relevant RealSec module.
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.