Prepares for incident response and recovery to maintain critical operations.

Ensures proper evaluation, testing, and approval of security controls.

Defines how connected systems interact securely while establishing standards for shared data and communication.

Focuses on evaluating and addressing risks to the organization.

Manages insider threats through background checks, role separation, and training.

Protects the integrity, confidentiality, and availability of communications within systems.

Focuses on ensuring security in external partnerships, procurements, and services.

Tracks actions and events to detect potential security breaches or policy violations.

Ensures proper maintenance of systems to prevent and detect vulnerabilities.

Provides oversight and organization for security policies and implementations.

Address the protection of personal and sensitive data within the organization's systems.

Safeguards data from unauthorized alterations and ensures reliable data exchange within systems.

Provides ongoing oversight and updates for organizational security systems.

Safeguards physical facility and system environment from threats.

Defines protocols for detecting, reporting, and mitigating security incidents.

Focuses on educating employees regarding security policies, threats, and best practices.

Addresses protocol for securely retaining or securely disposing of organizational data to prevent unauthorized access.

Coordinates an organization-wide security strategy and implementation.

Establishes minimum required security measures and configurations for systems to uphold uniform compliance.

Development, and Maintenance Family, Focuses on ensuring that new systems and applications are designed securely and tested for vulnerabilities before deployment.

Identifies privacy risks within new or evolving systems and recommends mitigations to uphold data protection laws.

Protects sensitive media (e.g., drives, paper) from unauthorized access, use, or destruction.

Ensures users and systems are uniquely identified and validated before use.

Guarantees that sensitive information is safeguarded through robust encryption and applied cryptographic measures.

Evaluates the effectiveness of training programs and security comprehension levels across the organization.

Monitors and protects systems against corruption or unauthorized modifications.

Ensures the accuracy, completeness, and relevance of organizational data to maintain trustworthiness and functionality.

Controls the setup and maintenance of secure system configurations.

Promotes thorough, accessible records for systems, policies, and implemented security controls to ensure compliance.