Information security management requires brains as the first resource: there must be somebody, in the organization, who "groks security", understands what is going on, and thinks about the issues. This will be the CISO, in fact if not in title.
ISMS are pre-digested tools which will help a CISO cope with the sheer size of the scope of information security in big organization. Their existence is justified only in that case; they are heavy artillery. An analogy: to properly defend a country, you need an army. An army implies a lot of logistics, for weaponry, lodging, feeding, and otherwise managing the troops; this will imply a lot of administrative personnel and buildings and furniture and budget. To defend your house against burglars, you don't need an army; and, indeed, there is no package "army for your house" readily on sale (unless you extend the term "army" to cover the concept of "a dog", but that's a stretch).
In a small organization, the information security situation ought to be of sufficiently low complexity that a proto-CISO can handle it without using heavy tools, and such tools would only slow him down without really helping him.
In any case, ISMS do not replace the brainy-thinking part of information security, they just complement it when faced with a situation too complex to handle in a single human mind.