Information Security Management System (ISMS)

What is LIS?

Plan–Do–Check–Act

The Information Security Management System (ISMS, Swedish: LIS) is KTH’s common framework for information security work. It covers all information for which KTH is responsible and applies to employees, students, and others who use KTH’s information resources. The system clarifies responsibilities, ways of working, and baseline requirements across the organisation, and is also used as a basis for setting information security requirements for external parties.

Core principles of information security

Information security work at KTH is based on three core principles:

• Confidentiality – information shall only be accessible to authorised persons.
• Integrity – information shall be accurate and protected against unauthorised modification.
• Availability – information shall be available when required by the organisation.

How does KTH work with information security?

The work follows the Plan–Do–Check–Act (PDCA) model, which provides a structured and continuous approach where information security is planned, implemented, monitored, and improved over time. The work is risk‑based and continuously adapted to changing requirements, threat landscapes, and organisational needs.

Roles and responsibilities

KTH’s management team has overall responsibility for information security. The CISO coordinates and drives the information security work, while responsibility for implementation and compliance is distributed to relevant parts of the organisation, such as IT, information risk owners, contract owners, and managers.

More information

These pages provide further information on how the ISMS is structured, how information security work is carried out at KTH, and what responsibilities different roles have.