Firstly, implementing an ISMS based on ISO/IEC 27001 shows that an organization is serious about the way it views its information security responsibilities and embraces internationally-recognized best practices. Secondly, a certified ISMS provides an organization with an externally-verified way of demonstrating that it has in place the controls to adequately protect the organization’s information assets. It is almost a near certainty (in all but the most efficiently operated organizations) that the implementation of an ISMS will reap many improvements in how the owning organization exercises its internal controls. An ISMS can also make the organization's information security strategy "defensible". Should a breach occur that results in damages to a third party, the existence of a certified ISMS could be used as a due diligence defense in court. This may «caveat, ‘may’ – nothing certain!» limit the damages for which the organization could be liable.