A documented, risk-based management system for information security — the object of ISO 27001 certification.
An Information Security Management System (ISMS) is a structured, risk-based management system covering people, processes, and technology used to manage information security. Clauses 4–10 of ISO 27001 define the mandatory management-system requirements (context, leadership, planning, support, operation, evaluation, improvement).
Run a free ComplianceIQ audit against ISO 27001 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.