Source: https://www.club-27001.fr/attachments/article/128/club27001-ProcessusSMSI12.pdf