# SP-018 Information Security Management System

Status: published. Release 26.06.2. Modified 2026-05-14. Licence: CC BY-SA 4.0.

Scope: The Information Security Management System pattern is the catalogue umbrella under which every other OSA pattern operates. It defines the management capability -- context, leadership, policy, risk treatment, resources, supplier governance, performance evaluation and continual improvement -- that selects, governs, monitors and improves the technical and operational controls described elsewhere.
Use when: Any organisation with a computing environment that must be secured in a structured manner to meet business, legal, regulatory, or industry requirements. Organisations pursuing or maintaining ISO/IEC 27001 certification, SOC 2 Type II examination, or BSI IT-Grundschutz certification.
Not when: There are no legitimate contra-indications at meaningful organisational scale.

## Controls (36, NIST SP 800-53 ids)
- Critical (14): CA-01, CA-02, CA-05, CA-07, PL-01, PM-01, PM-02, PM-09, PM-31, RA-01, RA-03, RA-07, SR-01, SR-02
- Important (20): AT-01, AT-02, AT-03, AU-01, CA-04, PL-02, PL-04, PL-09, PL-10, PM-03, PM-06, PM-11, PM-13, PM-29, PS-01, PS-09, RA-02, RA-09, SA-02, SR-03
- Standard (2): CA-03, IR-01
- Withdrawn from SP 800-53 by NIST: CA-04 (now in CA-02)

## What each critical control mitigates (14)
- CA-01 Policy and Procedures: T-IS-001, T-IS-014
- CA-02 Control Assessments: T-IS-002, T-IS-004
- CA-05 Plan of Action and Milestones: T-IS-002, T-IS-004, T-IS-013
- CA-07 Continuous Monitoring: T-IS-002, T-IS-003, T-IS-004, T-IS-012, T-IS-013, T-IS-014
- PL-01 Policy and Procedures: T-IS-001, T-IS-008, T-IS-012, T-IS-014
- PM-01 Information Security Program Plan: none of the threats below
- PM-02 Information Security Program Leadership Role: T-IS-015
- PM-09 Risk Management Strategy: T-IS-001, T-IS-011, T-IS-012
- PM-31 Continuous Monitoring Strategy: T-IS-003, T-IS-013, T-IS-014
- RA-01 Policy and Procedures: T-IS-001, T-IS-012
- RA-03 Risk Assessment: none of the threats below
- RA-07 Risk Response: none of the threats below
- SR-01 Policy and Procedures: T-IS-009, T-IS-011
- SR-02 Supply Chain Risk Management Plan: T-IS-009, T-IS-011

## Threats and the controls that mitigate them (12)
- T-IS-001 Governance failure where security decisions are made without structured risk assessment: RA-01, PM-09, PL-01, CA-01
- T-IS-002 Regulatory non-compliance and audit failure leading to fines, certification loss or commercial impact: CA-02, CA-04, CA-07, CA-05
- T-IS-003 Undetected security incidents persisting in the environment due to absent or weak monitoring capability: CA-07, PM-31, PM-06
- T-IS-004 Control degradation and operational drift where implemented controls silently lose effectiveness: CA-07, CA-02, RA-09, CA-05
- T-IS-007 Policy non-compliance by personnel due to weak awareness, training or enforcement: AT-01, AT-02, AT-03, PL-04, PS-01
- T-IS-008 Knowledge loss and undocumented security processes when expertise leaves the organisation: PL-01, PL-02, PS-09, AT-03, PM-13
- T-IS-009 Third-party and supply chain security gaps creating inherited and concentration risk: SR-01, SR-02, SR-03, CA-03
- T-IS-011 Concentration risk in shared GRC platforms and audit firms creating sector-level exposure: PM-09, SR-01, SR-02, RA-09
- T-IS-012 Shadow AI usage outside ISMS scope expanding the attack surface faster than the management system can adapt: PM-09, RA-01, PL-01, AT-01, CA-07
- T-IS-013 Cyber-insurance evidence failure leading to coverage exclusions, claim denial or premium escalation: CA-07, PM-31, CA-05, AU-01
- T-IS-014 Multi-framework drift where ISO 27001, SOC 2, NIS2, DORA and ISO 42001 control sets diverge over time: PM-31, CA-07, PL-01, CA-01, PL-09
- T-IS-015 Management body insufficient training or competence to discharge ISMS accountability under NIS2 and DORA: PM-02, PM-29, AT-02, AT-03, PM-13

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-018/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-018/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 57 KB: /api/v1/patterns/SP-018
- Page for people: /patterns/sp-018/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-010 Identity Management Pattern; SP-013 Data Security Pattern; SP-014 Awareness and Training Pattern; SP-029 Zero Trust Architecture; SP-031 Security Monitoring and Response; SP-032 Modern Authentication; SP-034 Cyber Resilience; SP-035 Offensive Security Testing; SP-036 Incident Response; SP-038 Vulnerability Management and Patching; SP-042 Third Party Risk Management; SP-045 AI Governance and Responsible AI

This card, the API and the page are generated from one file. Checking one against another adds no evidence.