Information is one of the most important tools for gaining a competitive advantage, and its security is a key element of the entrepreneur's credibility and a necessary condition for meeting legal requirements. To ensure effective protection of information in an organization, traditional door locks, firewalls and a password-protected computer are not enough; a comprehensive approach to complex security issues is necessary. The article describes the course of design and implementation works in the field of building in Polska Telefonia Komórkowa "Centertel" - the operator of the Orange mobile telephony network - an information security management system (ISMS) compliant with the requirements of ISO / IEC 27001: 2005. The full implementation of the system and its certification was preceded by a pilot implementation in the selected functional area of the company. At the end of the article, the obtained benefits resulting from the implementation of the system are presented and practical conclusions are formulated.