The 11 areas of audit focus are:

• Corporate Security Management Objectives
• Systems Development and Maintenance Objectives
• Information Access Control Management Objectives
• Compliance Management Objectives
• Human Resource Security Management Objectives
• Information Security Incident Management Objectives
• Communications and Operations Management Objectives
• Organizational Asset Management Objectives
• Physical and Environmental Security Management Objectives
• Security Policy Management Objectives
• Disaster Recovery Plan and Business Continuity Objectives