Information Security Management Systems
A risk-based management system for protecting the confidentiality, integrity and availability of information.
Who this standard can apply to
Typical areas reviewed
Certification pathway
Application & Scope
Confirm the organization, sites, activities, requested standard and intended certification scope.
Document Review
Review relevant policies, procedures, records, objectives and management-system evidence.
Assessment / Audit
Evaluate implementation and objective evidence against the applicable requirements and approved arrangement.
Findings & Corrective Action
Where findings are identified, corrective action and supporting evidence are reviewed before closure.
Decision & Status
A defined decision is recorded with scope, validity and any applicable conditions or limitations.
Surveillance & Renewal
Ongoing status, surveillance and renewal requirements are managed according to the applicable certification arrangement.
Certification, where offered, applies only to the defined management-system scope and responsible certification arrangement. It does not mean that ISO itself has certified or endorsed the organization.