Ensures that only authorized users, processes, or devices can access resources.

Ensures users and systems are uniquely identified and validated before use.

Safeguards physical facility and system environment from threats.

Tracks actions and events to detect potential security breaches or policy violations.

Development, and Maintenance Family, Focuses on ensuring that new systems and applications are designed securely and tested for vulnerabilities before deployment.

Monitors and protects systems against corruption or unauthorized modifications.

Provides ongoing oversight and updates for organizational security systems.

Safeguards data from unauthorized alterations and ensures reliable data exchange within systems.

Establishes minimum required security measures and configurations for systems to uphold uniform compliance.

Address the protection of personal and sensitive data within the organization's systems.

Defines protocols for detecting, reporting, and mitigating security incidents.

Defines how connected systems interact securely while establishing standards for shared data and communication.

Guarantees that sensitive information is safeguarded through robust encryption and applied cryptographic measures.

Focuses on evaluating and addressing risks to the organization.

Promotes thorough, accessible records for systems, policies, and implemented security controls to ensure compliance.

Evaluates the effectiveness of training programs and security comprehension levels across the organization.

Addresses protocol for securely retaining or securely disposing of organizational data to prevent unauthorized access.

Provides oversight and organization for security policies and implementations.

Ensures proper maintenance of systems to prevent and detect vulnerabilities.

Manages insider threats through background checks, role separation, and training.

Protects sensitive media (e.g., drives, paper) from unauthorized access, use, or destruction.

Identifies privacy risks within new or evolving systems and recommends mitigations to uphold data protection laws.

Coordinates an organization-wide security strategy and implementation.

Controls the setup and maintenance of secure system configurations.

Focuses on ensuring security in external partnerships, procurements, and services.

Ensures the accuracy, completeness, and relevance of organizational data to maintain trustworthiness and functionality.

Focuses on educating employees regarding security policies, threats, and best practices.

Prepares for incident response and recovery to maintain critical operations.

Protects the integrity, confidentiality, and availability of communications within systems.