Access Control: Physical and Environmental Protection Encryption Malicious Code Prevention Systems Development, Acquisition, and Maintenance Personnel Security: Data Security Service Provider Oversight Business Continuity Considerations Insurance