And while it is absolutely worth it to stand up your own ISMS and become certified, it helps your decision to know exactly what you’re getting into. Exhibit proof of staff training and awareness programs that underline the importance of information security within the organization. ISO 9