What Is an ISMS and How Does It Work? A Practical Guide for GRC Analysts

Introduction

Imagine joining an organisation as a GRC Analyst and being asked to assess its information security arrangements.

The IT team tells you that multifactor authentication is enabled, devices have antivirus software, and the company performs regular vulnerability scans. The HR team confirms that employees receive security awareness training. Management also tells you that several information security policies have been approved.

These are positive measures, but do they mean the organisation has an effective Information Security Management System?

Not necessarily.

You would still need to understand how security risks are identified, who is responsible for managing them, whether controls are working as intended, how the organisation responds to weaknesses, and how management evaluates security performance.

This is where an Information Security Management System (ISMS) becomes important.

An ISMS provides a structured approach for managing information security risks across an organisation. It brings together people, processes, policies, technology, risk management and oversight into a system that can be maintained and continually improved.

In this article, you will learn what an ISMS is, how it works, how ISO 27001 supports its implementation, and the practical responsibilities of a GRC analyst.

1. What Is an Information Security Management System?

An Information Security Management System is a structured framework of policies, processes, responsibilities and activities used by an organisation to manage information security risks.

Its purpose is to protect the confidentiality, integrity and availability of information through a consistent, risk-based management approach.

These three principles are commonly called the CIA triad.

Confidentiality: Information is accessible only to authorised individuals or systems.

For example, a healthcare organisation must prevent unauthorised employees from accessing patient records.

Integrity: Information remains accurate, complete and protected against unauthorised or unintended modification.

For example, clinical information must not be altered without appropriate authorisation and traceability.

Availability: Information and supporting services are accessible when needed.

For example, a patient management platform should be available to healthcare professionals when they need to retrieve appointments or clinical documents.

An ISMS helps the organisation identify what could affect these objectives, select appropriate measures and determine whether those measures remain effective.

It is not limited to cybersecurity technology.

The system also considers organisational responsibilities, employee behaviour, supplier dependencies, physical security, business processes, management decisions and other factors that could affect information security.

2. Why Organisations Need an ISMS

Without a structured management system, information security activities can become fragmented.

An organisation might have a strong firewall but poor employee offboarding procedures. It may conduct vulnerability scans but fail to track remediation. It may have a comprehensive policy library but no reliable evidence that employees follow those policies.

The individual controls may exist, but there is no assurance that the organisation manages security risks consistently.

An ISMS addresses this problem by establishing a repeatable management process.

It helps organisations:

1. Understand their business environment and information security requirements.
2. Identify and evaluate information security risks.
3. Establish clear ownership and accountability.
4. Select and implement appropriate risk treatment measures.
5. Monitor security performance and control effectiveness.
6. Identify deficiencies and implement corrective actions.
7. Review and improve the system as business conditions and threats change.

Consider an organisation that discovers employees who have left the business still retain access to corporate systems.

Without an ISMS, IT might simply disable the accounts and consider the issue resolved.

Within a functioning ISMS, the organisation should also investigate why the accounts remained active, assess the associated risk, determine whether similar weaknesses exist elsewhere, assign responsibility for remediation, and verify that the changes prevent recurrence.

The difference is that an ISMS promotes systematic risk management rather than isolated problem-solving.

3. How ISO 27001 Relates to an ISMS

ISO/IEC 27001 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an ISMS.

An organisation can establish its own information security management arrangements without pursuing ISO 27001 certification.

However, using ISO 27001 provides a recognised structure for determining what an effective ISMS should address.

The current baseline for this learning pathway is ISO/IEC 27001:2022, including Amendment 1:2024.

The standard has two important elements that GRC practitioners must understand.

Management system requirements: Clauses 4–10

These clauses address how the organisation establishes and operates its ISMS.

Clause	Area	Practical meaning
4	Context of the organisation	Understand the organisation, interested parties and ISMS scope
5	Leadership	Establish management commitment, policy and responsibilities
6	Planning	Assess risks, plan treatment and define information security objectives
7	Support	Provide resources, competence, awareness, communication and documented information
8	Operation	Carry out planned activities, including risk assessment and treatment
9	Performance evaluation	Monitor performance, conduct internal audits and perform management reviews
10	Improvement	Address nonconformities and continually improve the ISMS

These requirements are connected.

For example, an organisation cannot make well-informed risk treatment decisions without first understanding its business context and information security risks.

Similarly, it cannot reliably determine whether its ISMS is effective without monitoring, reviewing and evaluating its operation.

The 2024 amendment also requires organisations to determine whether climate change is a relevant issue in their organisational context. Relevant interested parties may also have related requirements.

This does not mean every organisation must conclude that climate change is a significant information security risk. It means the organisation must consider relevance and make an appropriate determination.

Annex A: Reference security controls

Annex A contains 93 reference controls grouped into four categories:

• Organisational controls
• People controls
• Physical controls
• Technological controls

These controls support information security risk treatment.

However, an organisation is not simply expected to implement all 93 controls without considering its needs.

The organisation must determine which controls are necessary, compare its selections against Annex A to avoid overlooking relevant controls, and document inclusion and exclusion decisions in its Statement of Applicability.

It must also satisfy the management system requirements of Clauses 4–10 when claiming conformity to ISO 27001.

Important distinction: ISO 27001 is not just a list of technical security controls. It defines the management system through which information security is governed.

4. How an ISMS Works in Practice

An ISMS operates as a continuous process rather than a project that ends when policies are approved.

A useful way to understand its operation is through the Plan–Do–Check–Act (PDCA) improvement cycle.

PDCA is an explanatory management model, not a replacement for the specific requirements of ISO 27001.

Plan: Understand the organisation and establish the approach

The organisation identifies what it needs to protect, what requirements apply, what risks exist and how those risks will be managed.

Typical activities include:

• Understanding organisational context and interested parties.
• Defining and approving the ISMS scope.
• Establishing the information security policy and objectives.
• Assigning responsibilities and authorities.
• Defining a risk assessment methodology.
• Identifying risks and planning treatment.

Example: A healthcare technology company identifies unauthorised access to patient information as a significant risk because it operates a cloud platform holding sensitive records.

Do: Implement the planned arrangements

The organisation puts its plans into operation.

Activities may include implementing access controls, staff training, security monitoring, incident management processes and supplier security requirements.

The GRC function coordinates progress with responsible business and technical teams.

Example: IT implements role-based access controls and multifactor authentication, while HR and IT establish an agreed process for removing access when employees leave.

Check: Evaluate whether the arrangements work

The organisation reviews evidence and performance to determine whether requirements and security objectives are being met.

Activities may include:

• Reviewing risk assessments and treatment progress.
• Testing controls.
• Monitoring security metrics.
• Conducting internal audits.
• Reviewing incidents and exceptions.
• Holding management reviews.

Example: A quarterly access review finds that two former contractors still have active accounts.

This shows that the access management process may not be operating as intended, regardless of what the written policy states.

Act: Correct weaknesses and improve

Management and control owners address identified issues.

They may revise procedures, clarify responsibilities, strengthen controls or allocate additional resources.

Corrective actions should address underlying causes where appropriate, and their effectiveness should be evaluated.

Example: The organisation discovers that contractor termination notices are not consistently sent to IT. Management assigns process ownership, introduces an automated notification workflow and tests whether access is removed within the agreed timeframe.

The process then continues as risks, systems and business circumstances change.

Key lesson: An ISMS is effective because it creates a repeatable cycle of planning, operation, evaluation and improvement.

5. The Main Components of an Operational ISMS

Although ISO 27001 specifies management system requirements, it is useful for GRC analysts to think about the practical elements they will encounter in an organisation.

Governance and accountability

Leadership establishes direction and provides the authority and resources needed for the ISMS.

Business leaders and control owners are responsible for the activities and risks assigned to them.

The information security function coordinates the programme, advises management and monitors relevant outcomes.

Risk management

The organisation establishes methods for identifying, analysing, evaluating and treating information security risks.

Risk decisions should consider potential business impact, risk criteria and the organisation's agreed risk acceptance arrangements.

Policies and procedures

Policies communicate management expectations.

Procedures explain how activities should be carried out.

A policy may state that access must be removed promptly when employment ends. The supporting procedure should describe who initiates the removal, who completes it and what evidence is retained.

Security controls

Controls are measures used to address identified risks and other applicable requirements.

Examples include access restrictions, security awareness training, backup processes, vulnerability management and supplier security arrangements.

Monitoring and evidence

The organisation needs reliable information about whether its processes and controls are operating as intended.

Evidence may include approved documents, system logs, access review records, training records, test results, incident reports and management meeting minutes.

Audit and improvement

Internal audits evaluate the ISMS against defined criteria.

Management reviews consider performance and opportunities for improvement.

Nonconformities require appropriate correction, cause evaluation and corrective action.

These activities support an ISMS that can respond to changing conditions rather than remain dependent on documents created during initial implementation.

6. What Does a GRC Analyst Actually Do in an ISMS?

A GRC analyst contributes to the implementation, operation and assurance of the ISMS.

The exact responsibilities depend on the organisation's size, structure and maturity.

In a smaller organisation, one analyst might coordinate several ISMS activities. In a larger organisation, risk management, compliance, internal audit and technical assurance may be handled by separate teams.

Typical responsibilities include the following.

Conduct gap assessments

Compare existing organisational practices against the relevant ISMS requirements.

Identify gaps, collect supporting evidence and help management prioritise improvements.

Maintain risk and control records

Support risk owners in documenting risks, treatment decisions, control responsibilities and residual risks.

Maintain records such as risk registers, risk treatment plans and control trackers.

Coordinate policy development

Work with relevant stakeholders to draft, review, approve, communicate and periodically update information security policies and procedures.

Collect and evaluate evidence

Request information from control owners and evaluate whether the evidence supports claims about implementation and operation.

A document stating that quarterly access reviews are required does not prove that the reviews actually happened.

Track remediation

Record identified weaknesses, assign agreed actions, monitor deadlines and seek evidence that remediation was completed and effective.

Support audits and management reviews

Prepare evidence, coordinate interviews, track audit findings and produce management reports.

The analyst must also recognise the need for appropriate audit independence. Someone who designed or implemented a control should not be expected to provide an independent assessment of their own work.

Communicate security risks

Translate technical and operational findings into information that business leaders can understand.

For example, rather than simply reporting that contractor accounts remain active, explain the potential exposure, the affected business processes, the existing safeguards and the decisions needed.

An important principle: The GRC analyst does not automatically own every security risk or technical control.

Risk ownership and control operation normally sit with the relevant accountable business and technical functions. GRC helps establish the process, coordinate activities, challenge unsupported conclusions and provide assurance.

7. A Practical Example: MedSure Technologies Ltd

Throughout this learning pathway, you will work with a fictional organisation called MedSure Technologies Ltd.

MedSure is a UK healthcare technology company with 85 employees across the UK and an EU subsidiary.

It provides MedSure Cloud, a patient management platform used by 42 private healthcare organisations.

The company uses Microsoft Azure, Microsoft 365, GitHub and external service providers to support its operations.

Management wants to strengthen information security governance and improve customer confidence.

A prospective customer, Northbridge Healthcare Group, has requested ISO 27001 certification or acceptable equivalent independent assurance.

MedSure is not currently ISO 27001 certified.

The CEO wants the organisation to be ready for an external certification audit by March 2027, but readiness has not been established and no certification body has been appointed.

Your assignment

You have joined MedSure as a GRC Analyst, supporting the Head of Information Security.

The CEO has asked the security team to explain how the company can demonstrate that it takes information security seriously.

At this stage, you have only a company brief and a management note.

You do not yet have a complete risk register, a verified record of operating controls or sufficient evidence to conclude that the organisation meets ISO 27001 requirements.

What should your initial approach be?

You should first explain how an ISMS would provide an ongoing framework for managing information security risks.

You should also identify the information needed to understand the company's current position.

For example:

1. What activities, systems and information should fall within the ISMS scope?
2. Who is responsible for managing information security risks and operating controls?
3. What existing risk assessments, policies and security records are available?
4. How will the organisation evaluate control effectiveness?
5. How will management monitor progress and approve important decisions?

You should avoid making unsupported statements about compliance or certification readiness.

The CEO's target date is a business objective, not evidence that the organisation will meet the requirements by that date.

As you progress through the pathway, additional MedSure documents, stakeholder communications and operational evidence will become available.

Your decisions should always reflect the evidence available at that stage.

8. Documentation Is Not the Same as Control Effectiveness

One of the most important lessons for a GRC practitioner is the difference between documented intentions and actual security practices.

Consider the following example.

An organisation has an approved Access Control Policy stating that user access must be reviewed every quarter.

During an assessment, the IT manager provides the policy as evidence.

Is that sufficient to conclude that access reviews are operating effectively?

No.

The policy demonstrates that an expectation has been documented, but it does not establish that the review process operates as required.

A GRC analyst might request:

• Access review schedules.
• Completed review records.
• Evidence of who performed and approved each review.
• Records of inappropriate access identified.
• Evidence that required access changes were completed.

The analyst should then evaluate whether the evidence is relevant, sufficiently complete and consistent with the control's expected operation.

This is a recurring theme throughout ISMS implementation.

A technically implemented control may be ineffective. An approved procedure may not be followed. A control may operate successfully even where the supporting documentation requires improvement.

Your conclusions must distinguish these different situations.

9. Does Having an ISMS Mean an Organisation Is ISO 27001 Certified?

No.

An organisation may have an established ISMS without obtaining external certification.

Three concepts should be distinguished.

ISMS implementation: The organisation has established and is operating arrangements for managing information security risks.

ISO 27001 conformity: The ISMS meets the applicable requirements of ISO/IEC 27001. Such a claim must be supported by appropriate evidence.

ISO 27001 certification: An independent certification body has assessed the management system and issued certification within a defined scope.

Certification provides external assurance, but it does not mean that an organisation has eliminated all information security risks or that every system is completely secure.

It also does not automatically demonstrate compliance with every legal or contractual obligation.

For MedSure, management must distinguish its intention to pursue certification from its current, verified security position.

10. Common Mistakes When Understanding or Implementing an ISMS

Mistake 1: Treating ISO 27001 as a documentation exercise

Creating policies, registers and procedures is necessary in many areas, but documentation alone does not establish an effective management system.

Better approach: Ensure that responsibilities, operational activities, monitoring and improvement are supported by appropriate evidence.

Mistake 2: Making the security team responsible for everything

The security function cannot effectively own every business risk and operate every control.

Better approach: Assign responsibility and accountability to the relevant business and technical owners, with GRC coordinating and providing challenge.

Mistake 3: Assuming implementation means effectiveness

A control may exist without achieving its intended purpose.

Better approach: Evaluate both control design and operating effectiveness using suitable evidence.

Mistake 4: Focusing exclusively on Annex A controls

Security controls are only part of the ISO 27001 management system.

Better approach: Address organisational context, leadership, planning, support, operation, performance evaluation and improvement.

Mistake 5: Treating certification as the final destination

An ISMS must continue to operate and improve after an organisation obtains certification.

Better approach: Build processes that can remain effective as people, technologies, business activities and risks change.

11. Practical Workplace Exercise: Explain the Value of an ISMS

Scenario: You are supporting MedSure's Head of Information Security.

The CEO wants a short explanation of how implementing an ISMS will help the company manage information security risks and prepare for independent assurance.

Using the MedSure Stage 1 learner brief, prepare a 300–500 word management briefing.

Your briefing should:

1. Explain what an ISMS is in language that senior management can understand.
2. Explain why existing technical controls and policies are not sufficient on their own.
3. Describe how the organisation can use an ISMS to identify, treat, monitor and improve information security risks.
4. Identify at least three types of evidence MedSure would eventually need to demonstrate that its ISMS operates.
5. Explain why the March 2027 audit ambition cannot currently be treated as proof of certification readiness.

Expected deliverable: A short, professionally written management briefing.

Important: You are not being asked to produce an ISO 27001 gap assessment at this stage. You do not yet have sufficient information to perform one.

12. Key Takeaways

An ISMS is an ongoing management system for identifying, treating, monitoring and improving information security risks.

ISO 27001 provides recognised requirements for establishing and operating that system.

A functioning ISMS requires management commitment, clear responsibilities, risk-based decision-making, operational controls, reliable evidence and continual improvement.

GRC analysts play an important role by coordinating governance activities, maintaining risk and control records, assessing evidence, tracking deficiencies and communicating findings.

The most important principle to remember is that having security controls or approved documents does not automatically demonstrate that an organisation has an effective ISMS.

What Comes Next?

In the next article, Understanding Organisational Context and Interested Parties, you will learn how to examine an organisation's internal and external environment, identify the parties whose requirements matter, and understand the factors that influence its ISMS.

You will continue working with MedSure Technologies as new evidence becomes available.

References and Further Reading

• ISO/IEC 27001:2022 — Information Security Management Systems — Requirements: https://www.iso.org/standard/27001
• ISO/IEC 27001:2022/Amd 1:2024 — Climate Action Changes: https://www.iso.org/standard/88435.html

This article provides original educational guidance and does not reproduce the full text of the ISO standards. GRC Workshop is not an ISO certification body.