An ISMS is a set of rules and procedures that an organization uses to define, manage, control, maintain, and continuously improve information security.

An ISMS serves two main purposes:

1. Protect assets — Ensure that the organization's assets and information are adequately protected
2. Meet requirements — Fulfill legal, regulatory, industry, and market requirements

How it works in practice:

• Maintain a process for identifying and assessing information security risks
• Determine and implement controls
• Continuously improve over time
• Determine the protection needs of assets, define protective measures, and establish monitoring

Various standards (ISO 27001, BSI) provide frameworks for building an ISMS. Think of the ISMS not as a product you buy, but as an ongoing process that your organization runs.

Go deeper:

• Information security management (Wikipedia) — das ISMS als Zusammenspiel aller Sicherheits-Elemente einer Organisation (Richtlinien, Verfahren, Ziele), das Technik und Menschen orchestriert.

The ISO 27000 family includes 27000 (vocabulary), 27001 (requirements), 27002 (controls), 27003 (implementation), 27004 (measurement), and 27005 (risk management).

* The six core ISO 27000 standards — only 27001 (requirements) is certifiable. *

There are over 50 standards in the family, but these six are the most important:

Key distinction: ISO 27001 is normative (uses "shall" — hard requirements, certifiable), while 27002-27005 are informative (uses "should" — guidelines and recommendations, not certifiable on their own).

Go deeper:

• ISO/IEC 27000-series (Wikipedia) — Überblick über die gesamte Normenfamilie (über 90 Standards) und wie die sechs Kern-Standards zusammenspielen.