Is there an Information Security Management System (ISMS) existing for SME/ SMB, if not why ?

The so called GRC suites are mainly targeted towards Fortune 100 (may be up to fortune 1000) companies , considering the high cost, maintenance, TCO part of it. They'll be the only ones who'll have sufficient security budgets and roles like CISO to afford and run such programs (solutions) effectively.


Information security management requires brains as the first resource: there must be somebody, in the organization, who "groks security", understands what is going on, and thinks about the issues. This will be the CISO, in fact if not in title.

ISMS are pre-digested tools which will help a CISO cope with the sheer size of the scope of information security in big organization. Their existence is justified only in that case; they are heavy artillery. An analogy: to properly defend a country, you need an army. An army implies a lot of logistics, for weaponry, lodging, feeding, and otherwise managing the troops; this will imply a lot of administrative personnel and buildings and furniture and budget. To defend your house against burglars, you don't need an army; and, indeed, there is no package "army for your house" readily on sale (unless you extend the term "army" to cover the concept of "a dog", but that's a stretch).

In a small organization, the information security situation ought to be of sufficiently low complexity that a proto-CISO can handle it without using heavy tools, and such tools would only slow him down without really helping him.

In any case, ISMS do not replace the brainy-thinking part of information security, they just complement it when faced with a situation too complex to handle in a single human mind.

  • Could you please suggest some ISMS tool which will help in managing the organisation – sheyam Aug 6 '13 at 15:03
  • 4
    Well, after explaining that ISMS tools don't actually help in managing information security in small organizations, I certainly won't list tools which help, since there are none. – Thomas Pornin Aug 6 '13 at 15:10

There are many products that do what you've asked, but usually under the term: SIEM (security information and event management).

  • Splunk
  • Security Onion
  • McAfee
  • Symantec

Product recommendations are discouraged here, but you will quickly see that quality, price, and functionality differ greatly between the offerings and each organization has to decide what types of information it needs.

Google searches for "SIEM" instead of "ISMS" will yield richer results.

Not the answer you're looking for? Browse other questions tagged or ask your own question.