If you were tasked with improving an existing ISMS, what steps would you take to assess its effectiveness?