[0] Physical [Assets (What)] Business data model [Process (How)] Security mechanisms [People (Who)] Users, applications and user interface [Location (Where)] Platform and network infrastructure [Time (When)] Control structure execution [Motivation (Why)] 
Security rules, practices and procedures