An organization is looking for a framework to measure the efficiency and effectiveness of their Information Security Management System. Which of the following i...