資訊安全政策文件化(information security policy document)

資訊安全的責任歸屬(Allocation of imformation security responsibility)

資訊安全的教育訓練(information security education &trainning)

安全事件的通報機制(Reporting of security incident)

病毒的控制(virus security)

企業持續規劃的程序(Business continuity planning process)

軟體複製的管制(control of proprietary software copying)

組織相關紀錄的防護(safeguarding of organizational records)

資料保護(data protection)

資訊安全政策的遵行(compliance with security policy)

3