Unveiling ISO 27001: How does it work? ISMS – Part 2