The need for a management system for information security (LIS) often comes in the form of a requirement from a supplier, subcontractor, partner, authority or regulation.