Start with the management question.

What information matters, what could happen to it and who decides what to do?

The decisions, responsibilities and review practices that protect information.

Connect scope, risk treatment and review in one management system.

Describe scenarios, make treatment decisions and review uncertainty.

Make authority, accountability and escalation visible.

Understand objectives, implementation and ownership.

Judge what the evidence can and cannot demonstrate.

Plan proportionate enquiries and follow findings to closure.

Place a recognised ISMS standard within broader management practice.

Your first complete guide

What is information security management? connects the subjects with a fictional access-management example.