[0] Conceptual [Assets (What)] Business attributes profile [Process (How)] Security strategies and architectural layering [People (Who)] Security entity model and trust framework [Location (Where)] Security domain model [Time (When)] Security-related lifetime and deadlines [Motivation (Why)] 
Control objectives