An information security management system is a structured set of policies, processes, responsibilities, and controls for managing information-security risk. It helps an organization consistently protect the confidentiality, integrity, and availability of critical information.