The Cybersecurity Management System
The Cybersecurity Management System, or CMS, is the part of ShieldNet that turns a set of controls into a working system. It defines who is responsible, how you set goals, how you manage risk, and how you show that security is actually being run, not just written down. It is the layer that binds the whole framework together.
Why you need a management system
Doing good security is not only about individual controls. Someone has to own it, set direction, and keep it going as your organization changes. This is also a legal expectation. The Polish implementation of NIS2 asks regulated organizations to run a security management system. A full ISMS, like the one behind ISO 27001, can be heavy for a smaller organization. The CMS gives you a lighter path to the same purpose, built on ideas you already understand, so you can meet the expectation without a large project.
The CMS helps you meet the NIS2 management system expectation in a proportionate way. It is a practical method, not an official certification or a government stamp. It gives you, your partners and regulators clear evidence that security is being managed.
How the CMS works
The CMS stands on two simple ideas: managing real risk, and setting clear goals.
Risk based
You look at what could actually go wrong for your organization, decide what matters most, and put your effort where the real risk is. Security is sized to you, not copied from a large enterprise.
Goal driven with OKRs
You set clear objectives and key results, the OKR model, so security has direction and you can see progress. ShieldNet keeps this light, with a firm rule of no more than ten objectives in a year, so you stay focused.
A system that keeps running
Set your objectives
Decide what security should achieve this period, using OKRs.
Assess your risk
Understand what could go wrong and what matters most.
Apply the controls
Work through the ShieldNet controls across the five Action Zones.
Measure and review
Check progress against your objectives and your evidence.
The CMS is a cycle you repeat, at least once a year, not a document you write once.
Who does what
A management system works when responsibilities are clear. ShieldNet defines simple roles, which you can map onto your own organization, however small.
The Board
Owns security overall, approves direction and makes sure it has the resources it needs.
InfoSec Coordinator
Runs the management system day to day, keeps it moving and brings it together.
System Owner
Looks after the security of a specific system or service.
All Staff
Follow the basics and play their part, because security is a team effort.
Third-Party Provider
Suppliers and partners who must meet the security expectations you set.
How it connects to the rest
The CMS binds the framework. It runs the controls in the Standard, draws on the evidence templates in Annex A, and is the home for your organization's self-assessment when you certify.