How to systematize knowledge in the field of information security?

Question

Information Security

Good afternoon, I began to be interested in information security, the material is not particularly complicated, but the difficulty arises when it comes time to apply what has been read.
I wanted to know how the implementation of the ISMS is going on (what is it in general), how is the analysis going on, after what actions to do which, maybe there are some steps?
well, for example, technical support has an ISO model, with user support, it can be guided by this model to fix a problem, so to speak, a checklist for an employee, maybe there is a similar approach in information security?
help organize knowledge.
thanks in advance.

Answer 1

To study the ISMS and get acquainted with the checklist, study ISO2700x
You can take a free course on 27001

Answer 2

It is impossible to implement a ready-made system from scratch - primarily due to a qualitative misunderstanding of all parties involved.
In 99% of cases, the IS system passes (or gets stuck on) the maturity stages of the systems described in any guide:
- single implementations/changes based on the facts of events/risks;
- repeated (similar) actions, but without formalization;
- formalized process;
- managed, controlled, evaluated and optimized process.
Read COBIT 4.1.
The process of transition from one stage to another takes at least 1.5-2 years, sometimes up to 5-10 years.