{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/isms","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/isms/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/isms/"},"term":{"en":"Information security management system (ISMS)","da":"Ledelsessystem for informationssikkerhed (ISMS)"},"aka":{"en":["ISMS"],"da":["ISMS"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","era":2005,"summary":{"en":"The set of policies, roles, processes and records an organisation uses to run its information security in a planned, repeatable way.","da":"De politikker, roller, processer og dokumenter, en organisation bruger til at styre sin informationssikkerhed planlagt og ensartet."},"body":{"formal":{"en":"A management system, as specified in ISO 27001, that defines its scope, assigns roles and ownership, chooses controls from a risk assessment, measures how well they work and improves them through internal audit and management review.","da":"Et ledelsessystem, som fastlagt i ISO 27001, der fastlægger sit omfang, fordeler roller og ejerskab, vælger kontroller ud fra en risikoanalyse, måler, hvor godt de virker, og forbedrer dem gennem intern audit og ledelsens evaluering."},"plain":{"en":"Like the way a well-run restaurant kitchen works - not one recipe, but the routines for buying, storing, cooking, cleaning and checking that keep every meal safe, whoever is on shift.","da":"Som et velfungerende restaurantkøkken - ikke én opskrift, men rutinerne for indkøb, opbevaring, madlavning, rengøring og kontrol, der holder hvert måltid sikkert, uanset hvem der har vagten."},"inPractice":{"en":"A Danish software company with 80 staff names a security lead, writes down which systems the work covers, repeats its risk assessment every year, keeps a list of chosen controls and has management review the status each quarter.","da":"En dansk softwarevirksomhed med 80 ansatte udpeger en sikkerhedsansvarlig, skriver ned, hvilke systemer arbejdet dækker, gentager risikoanalysen hvert år, fører en liste over valgte kontroller og lader ledelsen gennemgå status hvert kvartal."},"whyItMatters":{"en":"One-off security fixes fade or are forgotten when the person behind them leaves; a standing system of owners, reviews and records keeps the work going as people and threats change.","da":"Enkeltstående sikkerhedstiltag forsvinder eller glemmes, når den, der stod bag dem, rejser; et varigt system med ejere, evalueringer og dokumentation holder arbejdet i gang, når mennesker og trusler skifter."}},"deepDive":{"en":"ISO/IEC 27001:2022 does not define an ISMS as a tool or a binder of documents but as a set of interacting processes that the organisation must \"establish, implement, maintain and continually improve\" (clause 4.4). Its boundary is fixed in clause 4.3: the scope statement has to take account of internal and external issues (4.1), the requirements of interested parties (4.2) and the interfaces and dependencies between the organisation's own activities and those performed by others. Scope is the most consequential design decision in the whole system. A certificate covering \"the hosting platform in Aarhus\" says nothing about the support desk abroad or the SaaS product built on top, and customers, auditors and NIS2 supervisors increasingly read the scope statement before they read the certificate.\n\nThe core mechanics form a closed loop of documented information. Risk assessment (6.1.2) requires defined risk acceptance criteria, identification of risks to confidentiality, integrity and availability, named risk owners, and a method that produces consistent, valid and comparable results when repeated. Risk treatment (6.1.3) selects controls from any source, compares them with Annex A so that nothing necessary is overlooked, and produces the Statement of Applicability plus a treatment plan whose residual risks the risk owners formally accept. Objectives (6.2) must be measurable where practicable, and 6.3, added in 2022, requires changes to the ISMS itself to be planned. Clause 8 repeats the assessments at planned intervals or when significant changes occur, clause 9 covers monitoring and measurement (9.1), internal audit (9.2) and management review (9.3), and clause 10 deals with nonconformities through correction, root-cause analysis and corrective action.\n\nBecause ISO 27001 uses the harmonized structure shared with ISO 9001, ISO 22301 and ISO/IEC 42001, an ISMS is often run as one part of an integrated management system with common document control, a joint internal audit programme and a single management review. ISO/IEC 27701:2025 follows the same skeleton as a standalone privacy information management system, no longer an extension that presupposes 27001.\n\nTypical failure modes are a \"paper ISMS\" in which the policies exist but the risk register has not changed since the certification audit, a scope drawn to exclude the difficult parts of the business, risk owners who are IT staff rather than managers with authority to accept risk, and metrics that count activity (courses held) rather than effect. An ISMS also differs from a catalogue such as the CIS Controls or an outcome framework such as the NIST CSF: those describe what to achieve, whereas the ISMS is the governance machinery that decides which of those things apply, who owns them and whether they work. Accredited certification over a three-year cycle of initial, surveillance and recertification audits verifies that machinery, not that the organisation is secure.","da":"ISO/IEC 27001:2022 definerer ikke et ISMS som et værktøj eller en mappe med dokumenter, men som et sæt samvirkende processer, organisationen skal etablere, implementere, vedligeholde og løbende forbedre (afsnit 4.4). Afgrænsningen fastlægges i afsnit 4.3: omfangsbeskrivelsen skal tage højde for interne og eksterne forhold (4.1), interessenternes krav (4.2) og grænsefladerne og afhængighederne mellem organisationens egne aktiviteter og dem, andre udfører. Omfanget er den mest vidtrækkende designbeslutning i hele systemet. Et certifikat, der dækker \"hostingplatformen i Aarhus\", siger intet om supporten i udlandet eller det SaaS-produkt, der er bygget ovenpå, og kunder, auditorer og NIS2-tilsyn læser i stigende grad omfangsbeskrivelsen, før de læser certifikatet.\n\nKernen er et lukket kredsløb af dokumenteret information. Risikovurderingen (6.1.2) kræver fastlagte kriterier for risikoaccept, identifikation af risici for fortrolighed, integritet og tilgængelighed, navngivne risikoejere og en metode, der giver konsistente, gyldige og sammenlignelige resultater, når den gentages. Risikohåndteringen (6.1.3) vælger kontroller fra en hvilken som helst kilde, sammenholder dem med anneks A, så intet nødvendigt overses, og udmønter sig i Statement of Applicability og en risikohåndteringsplan, hvor risikoejerne formelt accepterer de resterende risici. Målene (6.2) skal være målbare, hvor det er praktisk muligt, og 6.3, som kom til i 2022, kræver, at ændringer af selve ISMS'et planlægges. Afsnit 8 gentager vurderingerne med planlagte mellemrum eller ved væsentlige ændringer, afsnit 9 dækker overvågning og måling (9.1), intern audit (9.2) og ledelsens evaluering (9.3), og afsnit 10 håndterer afvigelser gennem korrektion, årsagsanalyse og korrigerende handlinger.\n\nFordi ISO 27001 bruger den harmoniserede struktur, som også ISO 9001, ISO 22301 og ISO/IEC 42001 bygger på, drives et ISMS ofte som én del af et integreret ledelsessystem med fælles dokumentstyring, et samlet internt auditprogram og én ledelsesevaluering. ISO/IEC 27701:2025 følger samme skelet som et selvstændigt ledelsessystem for privatlivsbeskyttelse og er ikke længere en udvidelse, der forudsætter 27001.\n\nTypiske fejl er et \"papir-ISMS\", hvor politikkerne findes, men risikoregistret ikke er rørt siden certificeringsaudit, et omfang, der er skåret til, så de vanskelige dele af forretningen falder udenfor, risikoejere, der er IT-medarbejdere frem for ledere med mandat til at acceptere risiko, og nøgletal, der tæller aktivitet (afholdte kurser) frem for effekt. Et ISMS adskiller sig også fra et kontrolkatalog som CIS Controls eller et resultatorienteret rammeværk som NIST CSF: de beskriver, hvad der skal opnås, mens ISMS'et er det styringsmaskineri, der afgør, hvad der gælder, hvem der ejer det, og om det virker. Akkrediteret certificering over en treårig cyklus med certificerings-, overvågnings- og gencertificeringsaudit efterprøver dette maskineri, ikke at organisationen er sikker."},"edges":[{"type":"requires","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"requires","to":"security/security-policy","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/pdca","why":{"en":"The system is kept alive by running the plan, do, check, act cycle again and again.","da":"Systemet holdes i live ved at gennemløbe cyklussen planlæg, udfør, kontrollér, handl igen og igen."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/statement-of-applicability","why":{"en":"The statement records which controls the system uses and why.","da":"Erklæringen dokumenterer, hvilke kontroller systemet bruger og hvorfor."},"confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27001:2022 - Information security management systems - Requirements","tier":"standard","publisher":"ISO/IEC"}],"draft":true}