diff --git a/content/notes/ass03-security-flaws-essay.md b/content/notes/ass03-security-flaws-essay.md
index ea678815e..03a894a64 100644
--- a/content/notes/ass03-security-flaws-essay.md
+++ b/content/notes/ass03-security-flaws-essay.md
@@ -8,8 +8,6 @@ tags:
 
 Jet Hughes 9474308
 
-# References
-- 
 
 # What are the articles?
 ## 2012 Honan Wired
@@ -165,4 +163,14 @@ lessons learned
 - value security over convenience/customer service
 - try to prevent information leaks
 - use security questions
-- 
\ No newline at end of file
+
+## threats
+
+# References
+- https://www.cisecurity.org/wp-content/uploads/2017/09/CIS-Controls-Guide-for-SMEs.pdf
+- https://support.google.com/a/answer/7587183?hl=en
+- https://gblogs.cisco.com/ca/2019/11/08/baseline-cybersecurity-controls-for-small-and-medium-organizations/
+- https://www.cisecurity.org/controls/cis-controls-list
+
+-   Organizational controls
+-   Baseline controls
\ No newline at end of file