11. Conclusion

Every organization, whatever its size or economic sector, is constantly subject to the occurrence of events. Whether foreseeable or unexpected, some of these events have consequences that are more or less penalizing, or even dangerous, for the business.

These hazards entail risks whose probability of occurrence and strength of impact require protective measures to be taken.

In the field of information security, the importance of actual or potential consequences means that risk management must be implemented. This risk management must be supported by a process that guarantees control.

The process we have just described enables us to identify risks, assess their possible impacts, define a plan for dealing with them and implement actions.

In this way, the Information Security Management System...