---
id: CP-376
slug: iso-27001-27002-isms
lang: en
title: ISO 27001 and 27002 information security management
description: What an information security management system (ISMS) changes for an employee and for management, with NIST and NCSC resources.
canonical_url: https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/
markdown_url: https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms.md
publisher: Brain (https://startbrain.io)
license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)
cite_as: Brain, "ISO 27001 and 27002 information security management", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/ (CC BY 4.0)
wing: 6
theme: safeguard_data
reflex: cr-032
schema: G3
updated: "2026-11-03"
translations:
  en: https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/
  fr: https://startbrain.io/cyberpedia/fr/articles/iso-27001-27002-smsi/
  de: https://startbrain.io/cyberpedia/de/articles/iso-27001-27002-isms-de/
  es: https://startbrain.io/cyberpedia/es/articles/iso-27001-27002-sgsi/
sources:
  - "n": 1
    title: Security and Privacy Controls for Information Systems and Organizations
    publisher: NIST
    url: https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final
    accessed: "2026-11-03"
  - "n": 2
    title: Risk management
    publisher: NCSC (UK)
    url: https://www.ncsc.gov.uk/collection/risk-management
    published: "2023-06-23"
    accessed: "2026-11-03"
  - "n": 3
    title: Cyber Security Toolkit for Boards
    publisher: NCSC (UK)
    url: https://www.ncsc.gov.uk/collection/board-toolkit
    published: "2023-03-30"
    accessed: "2026-11-03"
  - "n": 4
    title: Guide for Conducting Risk Assessments
    publisher: NIST
    url: https://csrc.nist.gov/pubs/sp/800/30/r1/final
    accessed: "2026-11-03"
  - "n": 5
    title: Cybersecurity Framework
    publisher: NIST
    url: https://www.nist.gov/cyberframework
    accessed: "2026-11-03"
  - "n": 6
    title: CSF 2.0 Resources
    publisher: NIST
    url: https://www.nist.gov/cyberframework/resources
    published: "2024-03-06"
    accessed: "2026-11-03"
  - "n": 7
    title: Cybersecurity Best Practices
    publisher: CISA
    url: https://www.cisa.gov/topics/cybersecurity-best-practices
    accessed: "2026-11-03"
  - "n": 8
    title: Cybersecurity and Privacy Reference Tool CPRT
    publisher: NIST
    url: https://csrc.nist.gov/projects/cprt/catalog
    accessed: "2026-11-03"
---

# ISO 27001 and 27002 information security management

This entry covers information security management in an organization (ISMS), from the point of view of an employee and of management. Only one of the sources cited here mentions an ISO standard, ISO/IEC 27001:2022 [1].

The sources cited here come from American and British public bodies (NIST, NCSC, CISA). They do not reproduce the text of the ISO standards, the text of the NIS 2 directive, or ANSSI publications. These points are therefore not described here: the entry sticks to what these sources establish about risk management, the role of management and control frameworks.

## In 30 seconds

- Where it happens: in any organization that manages cyber risk in a structured way, at management level as well as in the teams.
- What it aims at: deciding on security measures according to the organization's real risks, and not to tick a requirement box [2].
- The reflex: if an activity or a behavior looks suspicious to you, report it, because the simple act of reporting counts [7].

## Straight answers

### What is an ISMS, in practice?

The sources cited here do not define the term. The NCSC describes a similar approach: basic concepts, then high-level steps that can serve as a foundation for any cyber risk management process [2].

### How does it relate to ISO 27001 and 27002?

The sources cited here do not describe these standards. Only one mentions them: NIST publishes a mapping between its SP 800-53 Rev. 5 control catalog and ISO/IEC 27001:2022 [1]. NIST adds that these tables give a general indication of coverage, that equivalence should not be assumed from them, and that the mappings are not always one to one [1].

### What must management do?

The NCSC wrote a toolkit for boards. It accompanies a code of practice for cyber governance and aims to help boards build resilience and risk management into the people, systems, processes and technologies of the organization [3].

### What must an employee do?

CISA places strong passwords, software updates, caution with suspicious links and multifactor authentication under basic hygiene [7]. It writes that these basics apply to individuals as well as to organizations [7]. It also encourages reporting any suspicious behavior [7].

## What it changes for employees

For an employee, a management system shows up mainly in everyday rules and in knowing whom to turn to. CISA lists the basic hygiene habits: strong passwords, updates, caution with links, multifactor authentication [7]. It also offers training and workshops, for example an introductory workshop for local leaders on common threats and basic practices [7].

Reporting is part of the approach. CISA states that everyone can help stop a threat by reporting suspicious activity or strange behavior [7]. The sources cited here do not specify the internal procedure of any given company: it depends on the organization, which is the one to communicate it.

## What it changes for management

The NCSC writes that improving business outcomes should be the main driver of cyber risk management. It advocates management that "illuminates the real cyber risks" of the organization, rather than techniques that only seek to satisfy compliance requirements [2]. It specifies that its guidance is not prescriptive and that no single technique suits every situation [2].

For boards, the NCSC has published a toolkit organized around the Cyber Governance Code of Practice. It contains two introductory modules, one of them for those new to cyber security, as well as a document of questions that the board can ask to assess the organization's performance [3].

In its SP 800-30 Rev. 1 guide (September 2012), NIST describes risk assessment as one part of an overall risk management process, which gives leaders the information they need to decide [4].

## What the text says

The ISO texts are not in the sources cited here: their precise content (requirements, controls, scope, statement of applicability, how a certification proceeds) is therefore not summarized here.

The sources do, however, provide elements on neighboring frameworks. The NIST SP 800-53 Rev. 5 catalog (published in September 2020) gathers security and privacy controls to protect operations, assets and people against varied threats, including hostile attacks, human errors and natural disasters [1]. It includes control families such as access control, awareness and training, incident response or risk assessment [1].

The NIST Cybersecurity Framework, in its version 2.0, is presented as a tool to reduce cyber risks, with quick start guides, profiles and mappings to other resources [5]. A starter guide aimed at small and medium-sized businesses offers resources to launch a risk management strategy [6].

Finally, NIST offers an online reference tool on cybersecurity and privacy, the CPRT [8].

## Where implementation stands

None of the sources cited here deals with the implementation of NIS 2, with European regulation or with ANSSI resources. None gives the duration or the timeline of an ISO 27001 certification. These elements remain to be documented with suitable sources.

What the sources allow us to say about the state of the cited frameworks: NIST published a minor version of SP 800-53, 5.2.0, on August 27, 2025, with new controls and revisions of existing controls [1]. It has also put online three self-paced introductory courses on the SP 800-53 catalog, its assessment procedures (SP 800-53A) and its baselines (SP 800-53B) [6]. The NCSC indicates for its toolkit a version 3.0, reviewed on April 8, 2025 [3].

## Sources

1. NIST, "Security and Privacy Controls for Information Systems and Organizations". https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed 3 November 2026)
2. NCSC (UK), "Risk management", 23 June 2023. https://www.ncsc.gov.uk/collection/risk-management (accessed 3 November 2026)
3. NCSC (UK), "Cyber Security Toolkit for Boards", 30 March 2023. https://www.ncsc.gov.uk/collection/board-toolkit (accessed 3 November 2026)
4. NIST, "Guide for Conducting Risk Assessments". https://csrc.nist.gov/pubs/sp/800/30/r1/final (accessed 3 November 2026)
5. NIST, "Cybersecurity Framework". https://www.nist.gov/cyberframework (accessed 3 November 2026)
6. NIST, "CSF 2.0 Resources", 6 March 2024. https://www.nist.gov/cyberframework/resources (accessed 3 November 2026)
7. CISA, "Cybersecurity Best Practices". https://www.cisa.gov/topics/cybersecurity-best-practices (accessed 3 November 2026)
8. NIST, "Cybersecurity and Privacy Reference Tool CPRT". https://csrc.nist.gov/projects/cprt/catalog (accessed 3 November 2026)

---

Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/
You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.