When organizations decide to "do something about cybersecurity," the first instinct is usually to buy something: a new firewall, endpoint protection, a monitoring service. These tools matter. But over 30 years in technology and security, I have watched well-funded organizations with impressive tools suffer serious breaches, while others with modest budgets managed their risk well. The difference was rarely the technology. It was whether security was run as a management system.
Tools answer narrow questions
A firewall decides which traffic gets through. It cannot tell you which services matter most, which data would hurt you if it leaked, who is accountable when something goes wrong, or whether you meet the Data Protection Act and your regulator's expectations, such as the Central Bank of Kenya's cybersecurity guidance for banks.
An Information Security Management System (ISMS), as defined by ISO/IEC 27001, answers those questions. It is the set of policies, processes, roles and controls an organization uses to manage information risk deliberately and consistently. Technology is one part of it.
What changed when we built one
When I led the implementation of an ISO 27001 ISMS, the biggest change was not technical. It was cultural.
Before, IT and the security team made most decisions about cyber risk on their own. Afterwards, cyber risk was tied to the organization's risk appetite and owned by the business. We built a common framework for assessing risk, so assessments became consistent and comparable across departments. Executives could finally weigh a cyber risk alongside financial and operational risks, using the same language.
The second change was focus. We inventoried every IT and data asset and classified each one by its value and risk. That simple discipline meant scarce budget and staff time went to the areas of highest risk, instead of being spread thinly or driven by the latest vendor pitch.
Start with the business
A sound security strategy follows business strategy and regulation. A bank growing through mobile lending has very different priorities from a ministry digitizing public records. Every significant security investment should trace back to a business objective, a regulatory obligation or a specific risk.
Why technology alone fails
Most serious incidents have mixed causes: a system nobody owned, a supplier with too much access, a phishing email, an unpatched server, an alert that was seen but not acted on. Each is a management failure as much as a technical one. With Kenya's Data Protection Commissioner now issuing penalty notices, those failures also carry regulatory and reputational cost.
A quick self-check for leaders
- Do we have an up-to-date inventory of our critical systems and data, classified by risk?
- Has the board agreed our appetite for cyber risk?
- Is cyber risk assessed with the same method as other enterprise risks?
- Can we show how our security spending maps to our top risks?
- Do we review and improve our controls on a regular cycle?
If these questions are difficult to answer, start there. An ISMS gives leaders a consistent way to assign responsibility, prioritize investment and assess whether security controls are working.