IaC (Infrastructure as Code) is an approach where you define and manage IT infrastructure — servers, networks, firewalls — through code files. Tools like Terraform, Ansible, or Pulumi apply these definitions automatically. For your ISMS, IaC brings significant advantages: configurations are versioned and traceable, deviations from the target configuration (configuration drift) become detectable, and recovery times shorten considerably. At the same time, a new risk emerges: the IaC code itself becomes a security-critical asset requiring access controls, code review, and secure storage. Treat IaC repositories with the same care as production code.