A statement of what the organization should achieve.

Controls for before, during, and after employment.

Contextual details, such as legal considerations or links to other standards.

Added controls for Cloud Services, Threat Intelligence, and Secure Coding 4. Strategic Value