In spite of critical information security threats, faced by academic institutions in Pakistan, very little research has been carried out on the need of implementing the information security management system (ISMS) and designing policies to cope with these security threats. Implementing international best security practices is not one time process, but it is a continuous process.