Nowadays, there is necessary a systemic approach in the field of information protection. It is required for the sustainable development and stable continuity of an organization’s activity to ensure the availability, confidentiality and continued integrity of information resources. The ISO/IEC 27 000 family of standards represents a systematization of the best practices accumulated over the years in this field. The mentioned standards help organizations seeking to establish and continuously improve an information security management system. The paper describes the stages of design and implementation of an information security management system, based on the requirements of the international standard ISO/IEC 27001: 2013. There is a simultaneous application of some technical and organizational methods, aimed at regulating of various activities with a direct or indirect impact on security of the organization’s information resources.