The purpose of an ISMS is to avert all threats posed to an information network. Benefits arise from the sum of all the risks assessed; this means from their probability of occurrence multiplied by the degree of potential damage.