What is an ISMS and how do you implement it with ISO 27001?
An ISMS (information security management system) is the set of policies, processes, responsibilities and controls an organization uses to decide, document and review how it protects information. ISO/IEC 27001:2022 defines the requirements for an ISMS in clauses 4 to 10 and provides a reference list of 93 controls in Annex A; an organization can be certified when a certification body verifies that its ISMS meets those requirements.
What is an ISMS for?
An ISMS manages information security as a management system: you set objectives, assess risks, apply controls and measure whether they work. Security stops depending on isolated efforts and becomes repeatable, measurable and demonstrable to customers, auditors and regulators.
The structure of ISO/IEC 27001:2022
| Clause | Topic | What you work on |
|---|---|---|
| 4 | Context | Internal and external issues, interested parties and ISMS scope |
| 5 | Leadership | Management commitment, policy and roles |
| 6 | Planning | Risk assessment and treatment, Statement of Applicability and objectives |
| 7 | Support | Resources, competence, awareness, communication and documented information |
| 8 | Operation | Running controls and periodic risk assessments |
| 9 | Performance evaluation | Monitoring and measurement, internal audit and management review |
| 10 | Improvement | Nonconformities, corrective action and continual improvement |
The 93 Annex A controls
The 2022 version groups controls into four themes: 37 organizational, 8 people, 14 physical and 34 technological. Not all of them apply to every organization: the Statement of Applicability states which apply, why, and their implementation status.
Which documents does an ISMS need?
- ISMS scope and information security policy.
- Risk assessment methodology and results, and the risk treatment plan.
- Statement of Applicability.
- Information security objectives and evidence of staff competence.
- Monitoring and measurement results.
- Internal audit program and results, and management review.
- Record of nonconformities and corrective actions.
Each organization also documents whatever it needs for the ISMS to be effective, such as topic-specific policies (access control, backup, suppliers) and procedures.
How does certification work?
Certification is granted by a certification body, usually in two stages: a documentation review followed by an audit of the implementation. The certificate is maintained through annual surveillance audits. The standard itself is sold by ISO or your national standards body; template packs do not include it.
Where to start
Define the scope, secure management commitment and run the risk assessment: it determines the controls you need and your Statement of Applicability. Editable templates save drafting time, but every document must be adapted to your organization. The NexoDocs toolkit brings together 84 Word and Excel files organized by stage, and you can try its risk matrix for free.
Frequently asked questions
Is an ISMS the same as ISO 27001?
No. The ISMS is the organization's management system; ISO/IEC 27001 is the standard that defines the requirements that system must meet to be certified.
How many controls does ISO 27001:2022 have?
Annex A has 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological.
Can a small business implement an ISMS?
Yes. The standard applies to organizations of any size; scope and documentation are scaled to each organization.
How long does ISMS implementation take?
It depends on scope and resources; for small organizations it usually takes several months from planning to controls implementation and the first internal audit.
Related guides
- ISO 27001:2022 mandatory documents: list by clause
- ISO 27001 risk assessment template: what it must include and how to use it
- ISO 27001 Statement of Applicability (SoA): what it is and how to write it
Updated: 2026-10-20