Proper use of encryption and key management.
A brief, specific recommendation for implementation.
Management direction for security.
A statement of what the organization should achieve.
Controls for before, during, and after employment.
Network security and information transfer.
ISO/IEC 27002:2013: A Comprehensive Code of Practice for Information Security Controls