An ISMS, or Information Security Management System, is a set of policies, procedures, and controls designed to manage an organization’s information security risks. It encompasses the people, processes, and technology involved in protecting and securing sensitive information from unauthorized access, use, disclosure, disruption, modification, or destruction.