1. Governance and Policy Management
2. Risk Assessment and Treatment
3. Access Control Management
4. Network Monitoring and Incident Management
5. Security Configuration Management
6. Training and Awareness
7. Backup and Recovery Management
8. Compliance and Auditing
9. Third-Party Management
10. Continuous Improvement