Source: https://www.itgovernance.co.uk/download/27001-2013-technical-guidance.pdf