Digital Lexicon Hub

The international requirements standard for establishing, implementing, maintaining and continually improving an information security management system.

A functioning ISMS creates accountable, risk-based security governance and can support assurance, procurement, regulatory alignment and independent certification.

A software provider scopes its ISMS, inventories information assets, assesses risks, selects treatments, documents a Statement of Applicability, monitors controls and undergoes independent certification audit.

Certification applies to a defined scope and does not prove that an organization is breach-proof or that every product is secure. A control checklist without risk context, operation and continual improvement is insufficient.

The standard requires an organization to determine its context and ISMS scope, assess and treat information security risks, operate documented controls and processes, evaluate performance and improve the system. Annex A provides a reference set of controls aligned with ISO/IEC 27002.