Guide
ISMS without an internal IT department: Allocate tasks sensibly
Organise information security with outsourced IT: clarify responsibilities, evidence and decisions without building your own IT department.
An ISMS does not need a department labelled “IT”. It needs people who understand requirements, implement measures and make decisions. An external IT provider can run technical operations. It does not automatically know which information supports your business or how much disruption you can tolerate.
Start with your services and the people involved. Our ISMS fundamentals guide explains the relationship between security objectives, risks and measures.
Assign specific tasks rather than blanket responsibility
“Our provider handles security” leaves open who reports new employees, approves permissions or assesses a restoration. Break recurring activities into manageable contributions.
| Activity | Organisation’s contribution | Provider’s contribution |
|---|---|---|
| An employee joins | Approve required access | Configure accounts and permissions within the agreed scope |
| An employee leaves | Communicate timing and affected access | Revoke agreed access and evidence completion |
| Test recovery | Describe the required business workflow and success criteria | Perform the technical test and supply results |
| Handle a security incident | Clarify business impact and decisions | Provide agreed technical analysis and response |
This allocation must match the actual contract. A table row does not turn an unagreed activity into a provider obligation.
NIST CSF 2.0 considers coordination with suppliers and partners alongside internal roles. It provides a basis for clear interfaces without requiring a particular IT department size. NIST CSF 2.0, GV.RR and GV.SC
Give someone responsibility for coordination
The coordinator does not need to answer every technical question personally. They need to recognise which answer is missing, who should provide it and when a decision is necessary.
Reserve working time and name a deputy. Assigning an extra role without capacity or backing does not solve the organisational problem. During GRC software implementation, clarify these contributions before the first import.
Ask about outcomes, rather than terminology
Ask providers to explain technical statements against your needs. “Backup running” does not answer whether the required process can be restored in time.
Agree which evidence answers a question, who reviews it and how unresolved points are handled. Our guide to current and verifiable evidence helps distinguish a file date from its actual relevance.
Fictional case: A small specialist business uses an externally operated file service. The provider confirms daily backups. The internal owner adds the missing test case: after an outage, can the team access documents for a current customer order? Together they define the test, required files and expected result. That result answers the operational question.
Involve employees in the workflows
Information security also concerns procurement, HR and business departments. They identify new providers, report departures and use documents daily. Describe their relevant steps clearly and name reachable contacts.
Kopexa’s Workforce Hub brings relevant documents and policies to employees. When versions change, affected people can be notified and reminded to read and complete a quiz; the corresponding evidence returns to Kopexa.
This does not replace a clear policy. It helps treat publication and acknowledgement as a connected workflow.
Regularly review open handovers
Review together: which task awaits information? Which measure has been implemented but lacks evidence? Where is a management decision missing? Escalate these points with a specific question rather than a blanket red status.
If additional consulting is needed, agree on handover of ISMS work alongside initial setup. The objective is sustainable operation that your existing people and providers can deliver together.
Test this workflow using one bounded case before distributing every requirement at once.
Quick answers
Frequently Asked Questions
Still have a question? Find the answers here.
Does an ISMS require an internal IT department?
No. Appropriate skills, clear responsibilities and effective workflows matter. Technical operations can be outsourced; business requirements and decisions still need assigned owners.
Can our IT provider answer every security question?
It can provide information about its service scope and technical implementation. The organisation must help assess which business processes are critical and which impacts would be acceptable.
Sources
- NIST Cybersecurity Framework 2.0 — NIST [Accessed ]