The certification requires organisations to put in place a broad range of internal information security risk controls designed to reduce the likelihood of information security incidents, whether innocent or malicious, and to reduce the impact of such incidents if and when they occur.