Does your organization have enough control over its IT systems?

Many small and medium-sized businesses lack sufficient in-house knowledge of IT and IT security.
As a result, they depend heavily on their IT service provider, whose focus in practice is mainly on keeping the systems running smoothly.

Security is usually offered as an additional service and is often left out because of the extra cost. Security measures are also sometimes set up once and never assessed for effectiveness again. This is known as a set-and-forget approach. In addition, it is increasingly reported that after a cyber incident, service providers adjust a few configurations and then move on to the next client.

It is therefore important that organizations keep control of their IT systems and data themselves and continuously monitor their security. This requires a sustainable approach. There are proven methods that help organizations to do this in a structured and easy-to-follow way.

Start simple with the ISMS method

An Information Security Management System (ISMS) helps organizations organize their information security in a structured way. It offers a systematic approach to identifying what needs to be protected, identifying and managing risks, and monitoring the measures taken. An ISMS covers a broader area, but here we focus specifically on cybersecurity.

An ISMS is not a cybersecurity product or digital tool that an organization can purchase, but the full set of principles, systems, settings, architecture, measures and procedures through which information security is organized.

Together, these components form a strong foundation for the continuity of your network and the reliability of systems and data. This reduces the likelihood of a cyber incident. Should an incident still occur, the consequences remain limited and your organization can recover faster.

What basic steps does an ISMS consist of for a structured and controlled approach to cybersecurity?

To apply an ISMS effectively, the following steps are required, in this order:

1. Plan: develop a plan for managing cybersecurity

To protect your organization’s information and data properly, start with an internal inventory that maps out what needs to be protected, which risks exist and which measures are needed to manage those risks. This includes the following:

• Map systems and data. Determine which IT systems are in use or will soon be in use and which data needs protection, such as personal data, sensitive business information and
  intellectual property.
• Determine access per role. Give employees access only to the systems and data they need for their work. Apply the principles of need-to-know and least privilege.
• Identify risks. Go through your processes: which actions are required, what can be
  automated, and where can things go wrong in the IT chain? Think of risks such as external emails with files or links, authentication for access to systems and data, and working outside the office.
• Determine appropriate measures for each risk. Also record which risks cannot be fully mitigated and therefore continue to require attention. Examples of measures are
  applications that detect malicious files and links, two-factor authentication (2FA), and a well-secured laptop with a secure virtual connection (VPN) to the internal company network.

2. Implement: put the measures from the cybersecurity plan into practice

The measures can be divided into three categories:

• Digital and technical measures

Apply digital and technical security measures wherever possible. The advantage is that they can be configured centrally in the systems, after which they apply across the entire organization.
Only authorized personnel can change these measures.

• Organizational measures

Complement the digital and technical measures with organizational agreements and procedures, such as a procedure for authorizing changes to IT systems, agreements with external parties on the quality of their services, and an incident response plan.

• Personnel measures

The human factor also requires attention. Personnel measures help promote and ensure secure behavior within the organization. Examples include staff screening, non-disclosure agreements and cybersecurity awareness training.

3. Evaluate: regularly check whether the measures are effective

Regularly check whether the measures taken achieve their purpose. This can be done, among other things, by monitoring activity within the IT systems and data traffic between systems. In addition, have independent audits carried out periodically on both the IT systems and the related processes.

4. Adjust: make changes where needed

Measures that prove to be ineffective must be adjusted, after which the cybersecurity plan should also be updated, as it remains the basis for implementing the measures.

This ISMS method can be applied to existing systems as well as when designing and developing new ones.

Steps in an ISMS visualized (PDF).

(Sources: RAC, Caricert. RAC publication period: 2026)