ISMS

What is an ISMS?

An ISMS (Information Security Management System) is the coherent set of policies, processes, roles, risk assessments and controls with which an organisation systematically protects the confidentiality, integrity and availability of its information and continually improves that protection. An ISMS is therefore not a software package but a way of organising: senior management sets objectives, risks are assessed in a structured way, controls are selected and their effectiveness is checked periodically. The best-known standard for an ISMS is ISO 27001; in OT environments the ISMS is supplemented with IEC 62443.

🧠 What does an ISMS do?

An ISMS turns information security from a collection of separate measures into a manageable process. Its core consists of four characteristics:

• Risk-based - controls follow from a risk assessment, not from a checklist; what carries little risk gets less attention
• Focused on the CIA Triad - confidentiality, integrity and availability of information, whether it is digital, on paper or inside a control system
• Cyclical - the ISMS follows the PDCA cycle (Plan-Do-Check-Act): plan, implement, measure and adjust
• Demonstrable - decisions, risks and exceptions are recorded, so an auditor, regulator or customer can verify that the organisation is in control and meets its compliance obligations

The difference from “just doing security well” lies in those last two points. A firewall, a SIEM or a backup procedure is a control; an ISMS makes sure someone owns it, that it is tested and that deviations lead to improvement. Information security thereby becomes part of governance rather than a task for the IT department alone.

🔧 What are the building blocks of an ISMS?

ISO 27001 follows the Harmonized Structure shared by all ISO standards for a management system. The requirements in clauses 4 to 10 translate into a fixed set of building blocks:

The Statement of Applicability is often the most consulted document. For each of the 93 controls in Annex A of ISO 27001:2022 it states whether the control is applied, why, and what its implementation status is. Excluding a control is allowed, provided you justify it. The 93 controls are grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological controls, ranging from access control to logging and monitoring. The 2013 version still had 114 controls in 14 domains; the transition period to the 2022 edition ended on 31 October 2025.

🔄 What is the difference between an ISMS, ISO 27001 and a CSMS?

An ISMS is the system itself; ISO 27001 is the standard that describes what that system must meet and against which you can be certified. You can therefore have an ISMS without a certificate. In industry a third concept comes in: the CSMS (Cyber Security Management System) from IEC 62443-2-1.

In the first edition from 2010 the OT programme was called a CSMS and overlapped heavily with ISO 27001. The second edition of IEC 62443-2-1, published in August 2024, restructures the requirements into security program elements, removes the duplication with an ISMS and adds a maturity model. The practical consequence: many organisations keep one ISMS as the umbrella and add the OT-specific requirements from IEC 62443 underneath it.

🏭 How do you apply an ISMS in an OT environment?

An ISMS that only covers office IT leaves the biggest risk out of view in a factory, water treatment plant or power station. Applying it to SCADA, PLCs, historians and MES requires a few adjustments:

• Extend the scope - include the production environment explicitly, including supplier connections and remote access
• Availability first - weigh downtime, people’s safety and environmental damage in the risk assessment, not just data breaches
• Take architecture into account - use the zones and conduits model and network segmentation as the basis for controls; a detailed risk assessment under IEC 62443-3-2 fits within the ISMS risk assessment
• Compensating controls - where patching is not possible, record in the SoA which alternative control covers the risk
• Roles across the boundary - let process engineers and IT security jointly own OT risks

An ISMS connects the technical security of IT and OT with organisation-wide decision-making about risk.

🛠️ How do you set up an ISMS step by step?

1. Management commitment - record who is ultimately accountable and what budget is available
2. Define the scope - choose which sites, processes and systems are included; better to start small and complete than broad and superficial
3. Inventory assets - map information, systems and installations, with owner and importance
4. Assess risks - choose a method, for example based on ISO 27005, and populate the risk register
5. Select controls - draw up the treatment plan and the SoA; use ISO 27002 as guidance per control
6. Implement and train - put controls in place, organise incident response and train staff
7. Measure and audit - carry out internal audits and hold a management review at least once a year
8. Improve - resolve nonconformities and adapt the ISMS after incidents or changes

A first working ISMS typically takes a mid-sized organisation several months to a year, depending on the scope and the existing level of security. If you aim for certification, an accredited certification body then performs a two-stage audit; the certificate is valid for three years, with annual surveillance audits.

🔐 Which laws and frameworks call for an ISMS?

• Dutch Cybersecurity Act (Cbw) - in force since 15 August 2026; its duty of care requires a risk-based approach with board accountability. The accompanying Cybersecurity Decree is largely aligned with ISO 27001 and NEN 7510 but does not require certification
• BIO - BIO2, adopted on 23 September 2025, follows the structure of ISO 27001 in part 1 and describes the ISMS that Dutch government organisations must set up
• NIS2 - the European directive behind the Cbw, with requirements for risk management, supplier security and business continuity
• AVG - the Dutch name for the GDPR, which requires appropriate technical and organisational measures for personal data; an ISMS helps make those demonstrable
• NEN 7510 - the Dutch standard for information security in healthcare, based on ISO 27001 and supplemented with healthcare-specific requirements

❓ Frequently asked questions

Is an ISMS mandatory?

An ISMS is not always literally required by law, but NIS2, the Dutch Cybersecurity Act and BIO2 demand a risk-based, demonstrable approach that in practice amounts to an ISMS. Customers and tenders also increasingly require an ISO 27001 certificate. For Dutch government organisations under the Cbw, an ISMS in line with BIO2 is the norm.

What is the difference between an ISMS and ISO 27001?

An ISMS is the management system an organisation sets up itself to steer information security. ISO 27001 is the international standard that lays down the requirements for an ISMS and against which a certification body can audit. You can build an ISMS in line with ISO 27001 without getting certified.

How long does it take to implement an ISMS?

Implementing an ISMS usually takes a mid-sized organisation several months to a year. The lead time depends on the scope, the maturity of existing controls and the available capacity. For certification the ISMS must also demonstrably work, including an internal audit and a management review.

What is a Statement of Applicability in an ISMS?

The Statement of Applicability (SoA) is the ISMS document that records, for each control in Annex A of ISO 27001, whether it applies, why, and whether it has been implemented. The SoA links the risk assessment to the selected controls. Auditors use the SoA as the starting point of their audit.

Does an ISMS also cover OT systems?

An ISMS can and should cover OT systems such as SCADA, PLCs and historians when they fall within scope. Because ISO 27001 has no OT-specific requirements, organisations supplement the ISMS with IEC 62443, for example for zones and conduits and compensating controls. NIS2 and the Dutch Cybersecurity Act make no distinction between IT and OT.

Who is responsible for an ISMS?

Ultimate responsibility for an ISMS lies with top management, which sets the policy, provides resources and reviews its effectiveness. Day-to-day coordination usually sits with a CISO or security officer. Risk owners in the line organisation, including production, are responsible for the controls in their own area.

📌 In summary

An ISMS is the management system with which an organisation organises, monitors and continually improves information security in a risk-based way. It combines policy, risk assessment, controls and audits in a PDCA cycle in line with ISO 27001, and in OT environments, together with IEC 62443, forms the basis for meeting NIS2, the Dutch Cybersecurity Act and BIO2.