| _ | Assets (WHAT) | Motivation (WHY) | Process (HOW) | People (WHO) | Location (WHERE) | Time (WHEN) |
| Contextual |
The Business |
Business Risk Model |
Business Process Model |
Business Organization and Relationships |
Business Geography |
Business Time Dependencies |
| Conceptual |
Business Attributes Profile |
Control Objectives |
Security Strategies and Architectural Layering |
Security Entity Model and Trust Framework |
Security Domain Model |
Security-Related Lifetime and Deadlines |
| Logical |
Business Information Model |
Security Policies |
Security Services |
Entity Schema and Privilege Profiles |
Security Domain Definitions and Associations |
Security Processing Cycle |
| Physical |
Business Data Model |
Security Rules, Practices and Procedures |
Security Mechanisms |
Users, Applications and User Interface |
Platform and Network Infrastructure |
Control Structure Execution |
| Component |
Detailed Data Structures |
Security Standards |
Security Products and Tools |
Identities, Functions, Actions and ACLs |
Processes, Nodes, Addresses and Protocols |
Security Step Timing and Sequencing |
| Operational |
Assurance of Operational Continuity |
Operational Risk Management |
Security Service Management and Support |
Application and User Management and Support |
Security of Sites and Platforms |
Security Operations Schedule |