The management perspective / Independent guidance
Information security management, from risk to evidence.
Understand the system behind secure information: the risks you assess, the decisions you own, the controls you operate and the evidence you review.
ISMS · Risk & governance · Controls · Assurance · ISO/IEC 27001
Governance in practice
Clear decisions. Useful evidence.
Review the risk. Agree the action. Keep a record.Original AI-generated editorial image
01 / Find your starting point
One discipline. Connected subjects.
Follow the relationships between management, risk, controls and assurance.
Management
The decisions, responsibilities and review practices that protect information.
02ISMS
Connect scope, risk treatment and review in one management system.
03Risk
Describe scenarios, make treatment decisions and review uncertainty.
04Governance
Make authority, accountability and escalation visible.
05Controls
Understand objectives, implementation and ownership.
06Assurance
Judge what the evidence can and cannot demonstrate.
07Audit
Plan proportionate enquiries and follow findings to closure.
08ISO 27001
Place a recognised ISMS standard within broader management practice.
02 / See the whole system
Security management is a cycle.
A policy is a starting point. Implementation, records and review make the system observable.
- Understand context
Identify information, obligations and dependencies.
- Assess risk
Describe plausible scenarios and their consequences.
- Choose treatment
Assign decisions, priorities and accountable owners.
- Implement controls
Turn decisions into operating practices.
- Collect evidence
Retain records that show what happened.
- Monitor and learn
Audit, review and improve as conditions change.
03 / Risk & governance
A risk needs a decision.
A decision needs an owner.
Describe the information at stake, the scenario and its consequence. Then make the treatment decision visible, with an accountable person and a reason to revisit it.
05 / Reference desk
Build your understanding.
Management / Pillar guide
What is information security management?
A practical introduction to decisions, ownership, controls and the evidence that connects them.
Controls / Supporting guide
What counts as useful control evidence?
Choose records that answer a control question, show operating activity and preserve useful context.
Audit & assurance
Ask what the record proves.
Evidence supports a judgement in a defined scope. Use enquiries, sampling and review to understand both its strength and its limits.
ISO/IEC 27001 in context
A standard within a broader discipline.
ISO/IEC 27001 concerns information security management systems. This publication also covers management practices that do not depend on certification.
How this publication works
Primary sources.
Independent explanations.
We distinguish official source material from our own explanations and illustrative examples. We do not reproduce standards or provide certification.