Riziko management forms the cornerstone of an ISMS. All ISMS projects rely on regular information security risk assessments to determine which security controls to implement and maintain.