Access Control Physical and Environmental Protection Encryption Malicious Code Prevention Systems Development, Acquisition, and Maintenance Personnel Security Data Security Service Provider Oversight Business Continuity Considerations Insurance