1. Leadership Commitment: Top management must be committed to the ISMS and provide the necessary resources. 2. Risk Assessment and Treatment: Identify and evaluate risks, then implement appropriate measures to mitigate them. 3. Information Security Policies: Establish and maintain policies that guide the organization in managing information security. 4. Internal Audits: Regularly conduct audits to ensure the ISMS is functioning as intended. 5. Continual Improvement: Continuously monitor, review, and improve the ISMS.