The "Checkpoints" That Companies Where ISMS Operations Become Hollowed Out Fail to Notice

Key points of this article (summary)

1. ISMS (Information Security Management System: a mechanism for systematically managing and improving information security) is prone to a state where only meetings and records remain, without leading to actual improvements

2. In organizations where it has become hollowed out, "keeping records" has become the goal

3. In companies where ISMS is functioning, operational results are reflected in actual rule improvements and business process enhancements

4. To prevent hollowing out, it is important to have checkpoints that verify the connection between meetings, records, and improvements

1. Why is ISMS operation prone to becoming hollowed out?

Companies that have acquired ISMS
periodically carry out the following operations.

• Security meetings

• Internal audits

• Risk assessments

• Training records

These are all
important operational processes for ISMS.

However, in actual practice,

"Meetings are being held"
"Records are also being kept"

despite this,

cases that do not lead to operational improvements are not uncommon.

The reason for this is that
even though the original purpose of ISMS is

"improvement"

it becomes a situation where

"records" become the goal.

2. Typical patterns where you tend to "think you are operating"

In companies where ISMS operations have become mere formalities, the following patterns are often seen.

① Meetings are being held

a. Security Committee
b. Risk Assessment Meeting
c. Annual Review

However, in these meetings,

• status reports

• reviewing previous meeting minutes

are all that happen, and
concrete improvement actions are not decided.

② Records are kept properly

In ISMS,

• meeting minutes

• training records

• internal audit records

, and many other documents are created.

However,

having records does not necessarily mean improvements are being made

.

③ Focus shifts to audit preparation

As ISMS operations continue for a long time,

• organizing only before audits

• Only responding to audit findings

It becomes easy to fall into this state.

In this state, it becomes
operations just for the sake of audits.

3. Three checkpoints to identify hollowed-out operations

To confirm whether ISMS operations are functioning,
checking the following points is effective.

1. Are meeting results leading to improvements?

In security meetings,

a. Issues
b. Response policies
c. Person in charge of implementation

it is important that these are clear.

Merely sharing the status
does not lead to improvements.

2. Is the risk assessment being updated?

Risk assessment is
the core of ISMS operations.

However, when it is hollowed out,

the first year's risk assessment may continue to be used as is

there are cases where this happens.

In reality,

• new systems

• new business processes

• new cloud services

and other aspects of the environment are changing.

3. Are there records of improvements?

In ISMS,

improvement activities (corrective actions)

are an important element.

Examples:

a. Rule changes
b. Operational improvements
c. Strengthening training

It is important to confirm whether such improvements
are actually being carried out.

4. Common actual cases of ISMS operation

At one company,
security meetings were held every month.

Minutes were properly kept, and
ISMS operations appeared to be fine.

However, when checking the content,

• information sharing only

• no action items

• no improvement measures

was a state that continued.

In other words,

the meetings were being held, but no improvements were occurring

was the situation.

In this case,

the way the meetings were conducted was reviewed,

• Issue organization

• Improvement lead

• Implementation deadline

By setting these,
ISMS operations were improved.

5. Perspectives for connecting ISMS to actual improvements

What is important in ISMS operations is

not "whether it is being operated," but
"whether it is leading to improvements"

.

To achieve this,

the following perspectives become important.

1. Clarify the purpose of meetings

a. Issue identification
b. Improvement decision
c. Implementation confirmation

Ensure they do not become mere reporting sessions.

2. Record improvement activities

In ISMS,

a history of improvements

is important.

Through this,

• organizational growth

• security maturity

You can check.

3. Simplify operations

If operations are too complex,

document creation becomes the goalinstead of the means.

By tailoring operations to actual work practices,
ISMS becomes a mechanism that contributes to actual security improvements.

ISMS is
not just a certification system, but

a mechanism for continuously improving organizational security

itself.

It is not just about having meetings and records remain, but
checking whether the results lead to

• rule improvements

• operational improvements

• security strengthening

is an important point for making the most of
ISMS operations.

For those considering streamlining security operations

Even if you have acquired ISMS,

• operations depend too much on specific individuals

• meetings and records are just for show

• improvement activities are not organized

there are not a few companies that face these issues.

By incorporating a third-party perspective,
you can organize the reality of your ISMS operations and
create a mechanism that leads to actual security improvements.

Please feel free to consult us regarding
the review and organization of your ISMS operations.

https://www.keep-on.jp/contact/

info@keep-on.jp

Request for Follows and Likes

Thank you for reading until the end.
If you found this article helpful, it would be a great encouragement if you could press theLikebutton.
We will continue to share information about corporate security operations and common on-site challenges, so please considerfollowingus as well.