From GAP analysis to the design and implementation of ISMS.