requirement-security and obligations imposed on an organzation. “This is is what somebody said you must do” controls-describe safeguard and protection capabilities to meet a specific objective. 1. adminstrative 2. technical 3. physical