3.2ISMS and controls

No matter how excellent individual technical controls (encryption, access control) are, security cannot be sustained without a mechanism for operating them consistently across the whole organization. ISMS systematizes that mechanism—"the organization's system for continuously managing and improving security." A Registered Information Security Specialist must go beyond memorizing standard clauses and correctly apply, in practice, "which standard defines what" and "what belongs at which tier of the policy."

3.2.1What is ISMS

• ISMS (Information Security Management System) refers to the entire management mechanism by which an organization selects and implements controls based on risk assessment to protect its information assets, and continually reviews them. Its defining feature is that it is a framework for operating individual technical controls organizationally, not a technical control itself.
• An organization pursuing ISMS certification conducts a risk assessment tailored to its own circumstances, selects the necessary controls, documents the rationale for applying or excluding each one, and undergoes assessment by a third-party certification body. Certification itself is not the goal; it is positioned as the foundation for a continuous improvement cycle.

3.2.2The division of roles between JIS Q 27001 and JIS Q 27002

• JIS Q 27001 defines the requirements for an ISMS (corresponding to ISO/IEC 27001). It specifies the mandatory obligations—such as "the organization shall conduct a risk assessment" or "management shall review the effectiveness of the ISMS"—that serve as the pass/fail criteria in a certification audit.
• JIS Q 27002 is a code of practice for controls (corresponding to ISO/IEC 27002). Where JIS Q 27001 requires "select controls," JIS Q 27002 illustrates and explains what concrete control options exist (access control, cryptography, physical security, etc.); it is not itself a certification requirement.
• In practice: consult JIS Q 27001 to confirm "what must be done to pass certification," and consult JIS Q 27002 to consider "which concrete controls to actually implement." The two stand in a complementary relationship of requirements versus practice guidance.

3.2.3The three tiers of an information security policy and PDCA

• An information security policy is structured in three tiers: policy, standards, and procedures. The policy (basic policy) is the top-level declaration set by management, stating "why the organization pursues security" and its "basic stance"—a highly abstract document that changes least frequently.
• Standards concretize the policy into criteria for "what and to what extent" to protect (e.g., passwords must be at least 12 characters, sensitive data must be encrypted). Procedures further concretize the standards into the lowest-tier documents defining "who, when, and how" to execute them (e.g., the steps for changing a password). Procedures are revised most frequently, in step with changes to operations or systems.
• The PDCA cycle—Plan (ISMS planning, risk assessment) -> Do (implementing and operating controls) -> Check (verifying effectiveness via internal audit and management review) -> Act (corrective action, continuous improvement)—repeats continuously. An ISMS is not built once and left alone; effectiveness is sustained by continuing to turn this cycle.

Suppose an ISMS officer at a mid-sized company receives an internal-audit finding: "the standards for accessing internal systems from personal devices during telework have not been documented." The officer's first decision is where in the policy hierarchy this standard belongs. The abstract direction—whether to permit telework at all, and how much risk the organization tolerates—should already be covered in the policy, so what needs to be newly written here is the concrete standard: "personal devices must have organization-approved MDM (mobile device management) software installed," "multi-factor authentication is mandatory for internal system access." Further, enforcing that standard in practice requires building out procedures—"steps for installing the MDM software," "steps for configuring multi-factor authentication." A judgment about which controls to select is also needed here: consulting JIS Q 27002 for illustrative controls on mobile devices and remote work, the officer selects controls (MDM deployment, multi-factor authentication) that match the organization's own risk assessment result (the risk of data leakage via personal devices was analyzed as high), and reflects them in the Statement of Applicability required by JIS Q 27001. If any illustrated control is deliberately not adopted, the reason (e.g., an equivalent risk reduction is achieved via an alternative control) must also be recorded in the Statement of Applicability. This whole sequence corresponds to the Plan-through-Do portion of the PDCA cycle, with effectiveness reconfirmed at the next internal audit (Check) and corrected if needed (Act)—continuous improvement.

3.2.4Section summary

• ISMS is the organizational mechanism for managing information security. JIS Q 27001 = requirements (mandatory), JIS Q 27002 = code of practice for controls (illustrative)
• The policy has three tiers: policy (abstract, low-frequency) -> standards (what and to what extent) -> procedures (who, when, how)
• Effectiveness is sustained by continually turning the PDCA cycle (Plan-Do-Check-Act), and the Statement of Applicability records adopted and non-adopted controls along with the reasons