The ISMS aims to protect the overall organization by providing guidance in managing security risks in the enterprise. It also contains procedures addressing information security risk assessment and management.