[0] Physical [Assets (What)] Business data model [Motivation (Why)] Security rules, practices and procedures [Process (How)] Security mechanisms [Location (Where)] Platform and network infrastructure [Time (When)] Control structure execution [People (Who)] 
Users, applications and user interface