An ISMS enables an organization to systematically operate its management system for information security. By establishing the ISMS, the organization can determine the necessary security level, make up plans and distribute its assets based on its own risk assessment in addition to technical countermeasures against each individual issue. The key concept of the ISMS is that an organization is to equally maintain and improve confidentiality, integrity, and availability of its information assets that should be protected by the organization. In particular, by measuring the effectiveness of controls implemented through risk assessment within the ISMS, the organization is able to improve its information security in a more efficient and effective way.