What it means
A management system
An ISMS organizes information-security governance, risk assessment, treatment and ongoing improvement. The standard addresses how an organization manages information security; it is not a list of guarantees about the safety of every product or transaction.
Read a certificate carefully
Certification relates to a defined organization, scope and assessment. Examine the issuing body, validity and included services rather than assuming that a supplier’s certificate covers every application, subsidiary or subcontractor. Operational evidence still matters when evaluating a payment integration.
Related concepts
In practice
A concrete example
A merchant checks whether a supplier’s certificate scope includes the service it plans to use, rather than relying only on an ISO logo.
Technical notes & boundaries
Certification does not guarantee the absence of breaches or establish compliance with every privacy, payment or financial regulation. BSI is cited as a standards body and certification provider.
Go to the source.
Original references used for this definition. Product details and standards can change.