✅ Defining the scope of the Information Security Management System.
✅ Risk analysis and assessment according to ISO 27005.
✅ Defining information security objectives and policies.