ITIL 4 Practitioner: Information Security Management

An organisation is defining the fundamental purpose of its Information Security Management practice. According to ITIL 4, which three properties of information assets should this practice primarily aim to safeguard?

A security manager wants to evaluate how effective and mature the organisation's Information Security Management is at mitigating risks and demonstrating compliance. Which concept is specifically intended to support this evaluation?