Internet-facing describes a system or service that is directly reachable over the internet. This includes web servers, email gateways, VPN endpoints, and public APIs. These systems face a significantly higher threat level than internal systems because any attacker worldwide can reach them. In your ISMS, internet-facing systems deserve special attention: shorter patch cycles, stricter hardening, regular vulnerability scans, and enhanced monitoring. Document all internet-facing systems in your asset inventory and label them accordingly so the risk analysis accounts for the increased exposure.