Section 11: Cybersecurity controls Section 12: Supply chain security Section 13: Incident management Section 14: Crisis management