Skip to content 
ISMS (Informationssicherheits-Managementsystem)
Information security does not arise from individual measures but from a system that identifies risks, sets rules and reviews regularly. This system is called an ISMS. It also decides how securely old devices and data carriers leave your company.
In brief
An ISMS (information security management system) is the entirety of rules, responsibilities, processes and measures with which an organization plans, controls, reviews and improves its information security. The best-known basis is the ISO/IEC 27001 standard, and in Germany also the BSI IT-Grundschutz. An ISMS also includes rules for the secure disposal and reuse of devices and data carriers.
What is an ISMS?
An ISMS is not a software product but a management system. It defines which information is worth protecting, which risks exist and who implements which measures. The goal is to permanently secure the confidentiality, integrity and availability of information. Like other management systems, an ISMS follows a cycle of planning, implementing, checking and improving. Experts speak of the PDCA cycle (Plan, Do, Check, Act).
Components of an ISMS
| Component | Contents |
|---|---|
| Policy | Management's commitment to information security, objectives and principles |
| Scope | Which locations, processes and systems the ISMS covers |
| Roles | Responsible persons, such as an information security officer |
| Risk assessment | Identify threats and vulnerabilities, assess risks, Need for protection to be defined |
| Measures | Technical and organizational measures that reduce the risks |
| Documentation | Policies, procedures and evidence |
| Review and improvement | Internal audits, management review, corrective actions |
ISO/IEC 27001 and BSI IT-Grundschutz
The international standard ISO/IEC 27001 describes the requirements for an ISMS. Companies can have themselves certified against it by an independent body. In its 2022 version, its Annex A contains a catalog of 93 measures in four themes: organizational, people, physical and technological.
In Germany, the BSI IT-Grundschutz is also widespread. BSI Standard 200-1 describes the requirements for an ISMS, BSI Standard 200-2 the procedure. The IT-Grundschutz Compendium provides concrete modules with requirements, for example on erasure and destruction.
The ISMS and decommissioned IT
At the end of the life cycle it becomes clear whether an ISMS is actually lived. ISO/IEC 27001 contains its own measures in Annex A for storage media, for the secure disposal or reuse of devices and for the erasure of information. A good ISMS therefore defines:
- who decides whether a data carrier is erased or destroyed,
- how old devices are secured until pickup,
- which requirements a service provider must meet,
- which proof is filed per device.
The measures overlap strongly with the technical and organizational measures (TOM) of the GDPR. An ISMS, however, protects all information, not just personal data.
Rule of thumb: an ISMS does not stop at the server room. It applies to every device until its data has demonstrably been removed.
ISMS at Second IT
Second IT is certified to ISO/IEC 27001 and is audited externally at least three times a year. For customers with their own ISMS, Second IT supplies the evidence needed there: digitally signed erasure certificates per device, certificates of destruction, audit reports in the customer portal and complete recording by serial number. Employees are bound to data secrecy, and non-disclosure agreements are concluded on request. More on Data secrecy and confidentiality. Which questions you should ask a service provider in advance is shown by our guide Choosing an ITAD provider.
Frequently asked questions about the ISMS
What is the difference between an ISMS and ISO 27001?
The ISMS is the management system itself. ISO/IEC 27001 is the standard that describes which requirements an ISMS must meet. A company can also build an ISMS according to BSI IT-Grundschutz.
Is an ISMS mandatory?
Not for every company. For certain sectors and institutions, laws require risk management for information security, and many customers demand it contractually. An ISMS is the usual way to achieve this.
What does an ISMS have to do with hardware disposal?
An ISMS governs the entire life cycle of information. This includes securely erasing or destroying devices and data carriers at the end and documenting it. ISO/IEC 27001 contains its own measures for this.
Who in the company is responsible for the ISMS?
Company management sets the policy, objectives and principles and commits to information security. Named responsible persons, such as an information security officer, take on the day-to-day tasks. The roles are laid down in writing in the ISMS.
What is the difference between an ISMS and data protection?
An ISMS protects all information of a company, the GDPR only personal data. The measures, however, overlap strongly with the technical and organizational measures (TOM) of the GDPR. Both require, for example, secure erasure and proof.
Evidence for your ISMS – erasure certificate per device and audit reports in the customer portal.
Send us your device list. You will receive your offer in 48 hours on average.