Asset Management Facilities and environment security Operations Management Telecommunications Access control Security requirements for contractors (third party) Purchase, development and maintenance of information systems Information security incidents management Priority 4 45 Technical security controls: Priority 3 35 Strategy and planning Information security management Awareness and training Human Resources Security Audit and compliance Assessment and performance improvement Priority 2 69 Administrative security controls: Priority 1 39 The standards consist of two main sets of security controls (administrative and technical), there are 188 controls distributed over 15 main areas and prioritized according to four priorities. 15