An Information Security Management System (ISMS) is a structured set of policies, processes, and controls that an organisation uses to manage information security risks systematically. Think of it as the "operating system" for how your company protects its data, systems, and people.

An ISMS is not a one-off project or a single document. It is a living system that follows the Plan–Do–Check–Act (PDCA) continuous improvement cycle. This means you plan your security measures, implement them, monitor their effectiveness, and continuously refine them.

Any organisation that handles sensitive information — customer data, trade secrets, employee records, financial systems — benefits from an ISMS. In practice, the ISMS is managed by a security team or CISO, but it involves everyone in the organisation: from the CEO who approves the security policy, to the warehouse worker who follows physical security rules, to the developer who follows secure coding practices.

Typical roles in an ISMS include a management sponsor (CEO/board), the ISMS owner (CISO or security manager), theme/area owners (IT lead, HR lead, facilities), and all employees who follow guidelines.

In daily operations, an ISMS translates into concrete activities: documenting your IT assets and who owns them, assessing risks to your information, creating security policies and distributing them to staff, handling incidents through a structured process, reviewing and improving your security posture regularly, and demonstrating compliance to auditors and customers.

ISO 27001 is the international standard that defines requirements for establishing, implementing, maintaining, and continually improving an ISMS. It is published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

The 2022 revision has two main parts:

Clauses 4–10 (Mandatory requirements): These 23 requirements cover the management system itself — context of the organisation, leadership commitment, planning, support, operation, performance evaluation, and improvement. Every organisation seeking certification must meet all of these.

Annex A (Security controls): 93 controls covering specific security topics like access control, cryptography, physical security, and incident management. These are grouped into 4 themes: Organisational (37), People (8), Physical (14), and Technological (34). Together with the clauses, Cyberday tracks 116 requirements total.

While ISO 27001 tells you what controls to implement, ISO 27002 is the companion standard that tells you how to implement them. It provides detailed implementation guidance for each of the 93 Annex A controls. When you're working in Cyberday and see a task linked to an Annex A control, the implementation guidance you'll find is based on ISO 27002. Think of 27001 as the "requirements checklist" and 27002 as the "implementation cookbook."

Cyberday (app.cyberday.ai) is a cloud-based ISMS platform. Its hierarchy works like this: you activate frameworks (e.g., ISO 27001), which generate tasks — the main content type. Tasks are organised into themes (permanent topic-based categories like "Technical cyber security" or "Risk management and leadership"). Each task links to one or more framework requirements.

Tasks have supporting content that serves as implementation evidence: documentation (assets, records, stakeholders), guidelines (rules distributed to employees), and reports (auto-generated documents like compliance reports). Together, these elements build your compliance score and assurance value.