十個控管要點：

1. 資訊安全政策文件化(Information security policy document)

2. 資訊安全的責任歸屬(Allocation of information security responsibilities)

3. 資訊安全的教育訓練(Information Security Education & Training)

4. 安全事件的通報機制(Reporting of Security Incidents)

5. 病毒的控制(Virus Controls)

6. 企業持續規劃的程序(Business Continuity Planning Process)

7. 軟體複製的管制(Control of proprietary software copying)

8. 組織相關紀錄的防護(Safeguarding of organizational records)

9. 資料保護(Data Protection)

10. 資訊安全政策的遵行(Compliance with security policy)

2