The purpose of the information security management practice is to protect the information needed by the organization to conduct its business. This includes understanding and managing risk to the confidentiality, integrity, and availability of information, as well as other aspects of information security such as authentication (ensuring someone is who they claim to be), and non-repudiation (ensuring that someone can’t deny that they took an action).