Security Testing as Part of an Information Security Management System looks outward: what happens to your results once they leave the test team. It covers acceptance criteria for security testing and how they influence the choice of approaches and techniques, feeding test results into an ISMS (information security management system, as described by ISO/IEC 27001) so that security risks can be actively managed, and improving the maturity of that ISMS through new test approaches, new test objects and better coverage.
The trap is studying the standard instead of the interface. Nobody is asking you to recite clauses of ISO/IEC 27001. What is asked is whether a given test result is usable as ISMS input — which means measurable, comparable over time, and tied to a risk the management system already tracks. A finding written as a colourful narrative is not ISMS input; the same finding expressed with a metric and a risk reference is.
Study it as a loop. Acceptance criteria come down from the management system and constrain your technique choice; results go back up as measurements; the measurements raise ISMS maturity, which tightens the next round of criteria. Practise deciding, for a described result, what makes it actionable at that level.
ISMS vs ISO/IEC 27001 — the management system is the thing your organization runs; the standard only describes it.
Acceptance criteria vs exit criteria — what the stakeholder requires of the product versus when this test effort is allowed to stop.
Measurable vs merely described — an ISMS manages risk on numbers it can trend; unquantified observations cannot be managed.
Criteria drive technique selection — the direction runs from acceptance criteria to test approach, not from the tooling you happen to own.
ISMS maturity vs test coverage — wider coverage is one of several inputs that raise maturity; they are not the same measure.
New test object vs new test approach — extending the ISMS to something never tested before differs from testing the same object a better way.
Contributing to risk management is not owning it — testing supplies evidence; the ISMS decides on treatment.
This chapter is covered most heavily (4 questions) in CT-STE — Mock Exam 1 (Zero Trust, Access Control & Threat Modelling), CT-STE — Mock Exam 2 (Attacker Profiling, DevOps Pipelines & Standards as Oracles), CT-STE — Mock Exam 3 (Reconnaissance Analysis, Standards & Regression)