Cyberpediaby Brain
ENDEFR

ISO 27001 and 27002 information security management

What an information security management system (ISMS) changes for an employee and for management, with NIST and NCSC resources.

In 30 seconds

Where it happens
In any organization that manages cyber risk in a structured way, at management level as well as in the teams.
What it aims at
Deciding on security measures according to the organization's real risks, and not to tick a requirement box2.
The reflex
If an activity or a behavior looks suspicious to you, report it, because the simple act of reporting counts7.

What it is

This entry covers information security management in an organization (ISMS), from the point of view of an employee and of management. Only one of the sources cited here mentions an ISO standard, ISO/IEC 27001:20221.

The sources cited here come from American and British public bodies (NIST, NCSC, CISA). They do not reproduce the text of the ISO standards, the text of the NIS 2 directive, or ANSSI publications. These points are therefore not described here: the entry sticks to what these sources establish about risk management, the role of management and control frameworks.

Straight answers

What is an ISMS, in practice?

The sources cited here do not define the term. The NCSC describes a similar approach: basic concepts, then high-level steps that can serve as a foundation for any cyber risk management process2.

How does it relate to ISO 27001 and 27002?

The sources cited here do not describe these standards. Only one mentions them: NIST publishes a mapping between its SP 800-53 Rev. 5 control catalog and ISO/IEC 27001:20221. NIST adds that these tables give a general indication of coverage, that equivalence should not be assumed from them, and that the mappings are not always one to one1.

What must management do?

The NCSC wrote a toolkit for boards. It accompanies a code of practice for cyber governance and aims to help boards build resilience and risk management into the people, systems, processes and technologies of the organization3.

What must an employee do?

CISA places strong passwords, software updates, caution with suspicious links and multifactor authentication under basic hygiene7. It writes that these basics apply to individuals as well as to organizations7. It also encourages reporting any suspicious behavior7.

1What it changes for employees1 min

For an employee, a management system shows up mainly in everyday rules and in knowing whom to turn to. CISA lists the basic hygiene habits: strong passwords, updates, caution with links, multifactor authentication7. It also offers training and workshops, for example an introductory workshop for local leaders on common threats and basic practices7.

Reporting is part of the approach. CISA states that everyone can help stop a threat by reporting suspicious activity or strange behavior7. The sources cited here do not specify the internal procedure of any given company: it depends on the organization, which is the one to communicate it.

2What it changes for managementManagement1 min

The NCSC writes that improving business outcomes should be the main driver of cyber risk management. It advocates management that "illuminates the real cyber risks" of the organization, rather than techniques that only seek to satisfy compliance requirements2. It specifies that its guidance is not prescriptive and that no single technique suits every situation2.

For boards, the NCSC has published a toolkit organized around the Cyber Governance Code of Practice. It contains two introductory modules, one of them for those new to cyber security, as well as a document of questions that the board can ask to assess the organization's performance3.

In its SP 800-30 Rev. 1 guide (September 2012), NIST describes risk assessment as one part of an overall risk management process, which gives leaders the information they need to decide4.

3What the text saysOfficial text1 min

The ISO texts are not in the sources cited here: their precise content (requirements, controls, scope, statement of applicability, how a certification proceeds) is therefore not summarized here.

The sources do, however, provide elements on neighboring frameworks. The NIST SP 800-53 Rev. 5 catalog (published in September 2020) gathers security and privacy controls to protect operations, assets and people against varied threats, including hostile attacks, human errors and natural disasters1. It includes control families such as access control, awareness and training, incident response or risk assessment1.

The NIST Cybersecurity Framework, in its version 2.0, is presented as a tool to reduce cyber risks, with quick start guides, profiles and mappings to other resources5. A starter guide aimed at small and medium-sized businesses offers resources to launch a risk management strategy6.

Finally, NIST offers an online reference tool on cybersecurity and privacy, the CPRT8.

4Where implementation stands1 min

None of the sources cited here deals with the implementation of NIS 2, with European regulation or with ANSSI resources. None gives the duration or the timeline of an ISO 27001 certification. These elements remain to be documented with suitable sources.

What the sources allow us to say about the state of the cited frameworks: NIST published a minor version of SP 800-53, 5.2.0, on August 27, 2025, with new controls and revisions of existing controls1. It has also put online three self-paced introductory courses on the SP 800-53 catalog, its assessment procedures (SP 800-53A) and its baselines (SP 800-53B)6. The NCSC indicates for its toolkit a version 3.0, reviewed on April 8, 20253.

Fact sheet

Identifier
CP-376
Wing
6. Governance and GRC
Brain skill
Safeguarding Data (safeguard_data)
Brain reflex
cr-032
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. NIST, “Security and Privacy Controls for Information Systems and Organizations”. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed 3 November 2026)
  2. NCSC (UK), “Risk management”, 23 June 2023. https://www.ncsc.gov.uk/collection/risk-management (accessed 3 November 2026)
  3. NCSC (UK), “Cyber Security Toolkit for Boards”, 30 March 2023. https://www.ncsc.gov.uk/collection/board-toolkit (accessed 3 November 2026)
  4. NIST, “Guide for Conducting Risk Assessments”. https://csrc.nist.gov/pubs/sp/800/30/r1/final (accessed 3 November 2026)
  5. NIST, “Cybersecurity Framework”. https://www.nist.gov/cyberframework (accessed 3 November 2026)
  6. NIST, “CSF 2.0 Resources”, 6 March 2024. https://www.nist.gov/cyberframework/resources (accessed 3 November 2026)
  7. CISA, “Cybersecurity Best Practices”. https://www.cisa.gov/topics/cybersecurity-best-practices (accessed 3 November 2026)
  8. NIST, “Cybersecurity and Privacy Reference Tool CPRT”. https://csrc.nist.gov/projects/cprt/catalog (accessed 3 November 2026)

Cite this article

Brain, “ISO 27001 and 27002 information security management”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/

BibTeX 
@misc{brain_cp376_en_2026,
  author = {Brain},
  title = {ISO 27001 and 27002 information security management},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/iso-27001-27002-isms/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence