a practical implementation of isms

nowadays, access to reliable information has become an essential factor leading to success in business. in this regard, adequate security of information and systems that process it is critical to the operation of all organizations. therefore organizations must understand and improve the current status of their information security in order to ensure business continuity and increase rate of return on investments. since, information security has a very important role in supporting the activities of the organization and for this reason; it is needed to have a standard or benchmark which controls governance over information security. hence, this paper discusses some of information security management system (isms) standards in order to determine their strengths and challenges. then, based on most appropriate standards in the field, a method is proposed to allow information technology-related or based enterprises to implement their isms. this method helps identifying critical assets and related threats and vulnerabilities, assessing assets risks and providing necessary risk treatment plans. the proposed method makes it possible and structured to establish information security management system in it related large-scale enterprises.