So let's have a look at what a management system is. Now if we look at ISO 27000, a clause 341 gives a definition on a management. So a management system is a set of interrelated or interacting elements of an organization to establish policies and objectives and processes to achieve those objectives. So basically it's a very complicated, or it seems a very complicated sentence, but it isn't really All organizations have some form of a management system because it's just the way you operate your business. It's nothing more complicated than that. It's a way on how you operate your business. So a coherent and a well-functioning management system combines processes, resources, tools and workforce And a management system can be very complicated or can less can be very documented or less documented depending on the maturity of the organization. So again, a documentation is not a purpose in itself. An appropriate level of documentation is Preferable because it will help you to ensure that consistency, continual improvement, and retention of organizational knowledge Of course, an organization changes in the course of its lifetime. You have an internal and external context It changes so um the management system really needs to be um agile as well, and it needs to be able to respond to those changes as well. So whenever setting up a management system Very important to keep in the back of your mind is whatever is implemented must be controlled and measured and what is controlled and measured must be managed. And so the performance evaluation clause in every ISO standard is a very essential component of any management system. Because everything that you write down should be able to be evidenced So you always need to think really hard on okay, what is it what we're going to do, and am I able to measure and to see if the control or whatever management system that we've implemented, if it's working effectively When looking at an information security management system, the ISO 27000 also gives some explanation about that. So an ISMS consists of the policies procedures, guidelines, and associated resources and activity collectively managed by the organization in the pursuit of protecting its information assets So it's again a very long sentence. So an ISMS is basically a systematic approach for both establishing, implementing, operating Monitoring, reviewing, maintaining, and improving the organization's information security to achieve its business objectives. And it's always based on a risk assessment approach and the risk appetite or the risk acceptance criteria from the organization to effectively treat and manage those risks. So a couple of things that are very important here, so it's a systematic approach, and very important is that an information security management system does not live in isolation. So it needs to be linked to the business activities. And it's always based on a risk management approach and the risk appetite of an organization to really treat and handle those risks. Now, when an organization, and uh today I see it more and more happening, uh, an organization can handle Multiple compliance frameworks. I see organizations that have an ISO 9001, they start with the 27,000 one, and they also want to Include the fourteen thousand one. If you want to do that, you want to um look for uh implementing an integrated management system In short, it's IMS. And it's really a management system that integrates all the components of a business into one coherent system to enable basically the achievement of its purpose and mission. If you look at um the table on the slide, you see and that's also the reason why um ISO has uh made a lot of changes to their ISO standards to ensure that The clauses 4 to 10 in each standard are pretty similar to each other. That's also the reason why they're called a harmonized structure. So if you look at leadership and commitment, for example, you see that in the ISO 9001, 14001, 2020, 20,000 23001 and 27001, and it all comes back to clause 5. 1. And more likely, the text that is in that clause is the same Policy comes back in all the ISO standards in 5. 2. The same for objectives, you can find them in 6. 2 documented information is always 7. 5 internal audit always 9. 2 management review 9. 3 Only with continual improvement you sometimes have three subclauses like is the case with 9000 and 14001 where uh you have it in 10. 3 and with the other standards in 10. 2 But the information that is in the continual improvement clause is exactly the same for all standards. So that will help you to harmonize and optimize practice. because it doesn't make sense to write in three different management systems the same explanation for leadership, for example. Of course, for a policy, you can say, oh, I want to create three different policies, but the way you set up a policy, the way it needs to be treated in the organization, it's the same So it will help you, of course, reduce duplication and therefore costs, of course. It will also reduce the risks. It will increase Profitability, it will help you to maintain consistency and it will for sure help you with uh improving the communication as well. So you if you work with different management systems consolidating into one is the best practice because it will also help you in communicating to the organization because otherwise it becomes pretty complex for your employees to understand what you're actually are talking about. Now apart from ISA publications range beside the ISO 27001 organizations can get certified against a lot of uh primary standards So ISO publications range from traditional activities such as agriculture and construction to the most recent developments of course in information technologies like as digital coding of audio visual signals for multimedia applications. So there are um a couple of standards that the organizations can still get certified against Mo the most well known and um I always say the oldest, but that's because I get older, is the ISO nine thousand one, uh which is quality management system. Uh twenty years ago that one was uh really uh was well known, uh was um Required for a lot of organizations. Today I see less questions about ISO 9000 and an increase on 2700001, but also on ISO 14001, which is an environmental management system. With the rise with everything related to climate change um and environmental uh issues the ISO uh 14001 is gaining in importance again, but it's already a pretty old standard as well. You can certify against ISO 45001, which talks about occupational health and safety The ISO 37301 is a compliance management system. We have uh a food safety management system which is 22000. Um we have business continuity management. Um 22301 also on the rise. I see a lot of customers asking for uh the business continuity management system Of course, also spiked through NIST2 regulations, increasing regulation on incident response and operational resilience There is an anti-bribery management system, ISO 37000 and one, and there is also a service management system which is ISO 2000- So you see there are a lot of primary standards that can be used, of course. If I look at this, I would say 9,000 and 14,001 would be the the two that are uh pretty well known uh throughout the world um with um the business continuity management system as third runner up um So yeah, if you want to have more information on each of the standards, you can also visit the PECB website again to get a little bit more information on each of them. standards. So it was a pretty long section that we've spoken about. So let me summarize a little bit. So the International Organization for Standardization In short, ISO publishes standards in response to market demand. ISO standards are based on global expert opinion and consensus and are developed through a multi-stakeholder process ISO 27001 specifies then the requirements for establishing, implementing, maintaining and improving an ISMS and assessing and treating information security. Risks. Advantages of implementing an ISMS can include the improvement of organizational security posture, achievement of good governance, increase of international recognition improvement of customer satisfaction and an increase of competitive advantage. A management system then refers to a set of interrelated and interacting elements of an organization to establish policies and objectives and processes to achieve those objectives, and organizations can two or more management systems by integrating them.