Goal: Select and implement necessary cybersecurity controls

Domain 1: Management & Governance

  1. Information Security Policy
  2. Acceptable Use Policy (AUP)
  3. Password Policy
  4. Remote Working Policy
  5. Bring Your Own Device (BYOD) Policy
  6. Data Classification & Handling Policy
  7. AI Usage Policy
  8. Removable Media Policy
  9. Web Publishing Policy
  10. Privacy Policy
  11. AI Disclosure Statement
  12. Backup & Recovery
  13. Alternate Sites
  14. Incident Response (IR) Team, Policy, and Plan
  15. Incident Response (IR) Procedures & Playbooks
  16. Data Breach Policy
  17. Disaster Recovery Plan (DRP)
  18. Business Continuity Plan (BCP)
  19. Third Party Risk Management Policy
  20. Configuration & Change Management (CM)

Domain 2: Physical

  1. Perimeter Security
  2. Entrance Protection
  3. Visitor Logs
  4. Device Locks
  5. Privacy Filters
  6. Privacy Shutters
  7. Asset Tags
  8. Cabling Security
  9. Server Room & Network Closet Protections
  10. Security Cameras
  11. Redundant Power Sources
  12. Surge Protection
  13. Temperature Control
  14. Fire Detection & Suppression
  15. Leak Detection
  16. Removal of Unnecessary Hardware Components

Domain 3: Personnel

  1. Screening & Background Checks
  2. Onboarding and Offboarding
  3. Nondisclosure Agreements (NDAs)
  4. Return of Assets
  5. Separation of Duties
  6. Job Rotation
  7. Mandatory Vacations
  8. Split Knowledge & Dual Authorization
  9. Clear Desks & Screens
  10. Contact With Law Enforcement & Cybercrime Authorities

Domain 4: Identity

  1. Identity Provider selection & standardization
  2. Identity & Access Management (IAM) Lifecycle
  3. Need to Know & Principle of Least Privilege (PoLP)
  4. Provisioning & De-Provisioning
  5. Role Based Access Control (RBAC)
  6. Attribute Based Access Control (ABAC)
  7. Privileged Access Management (PAM)
  8. Just Enough Access (JEA) & Just In Time (JIT) Access
  9. Account Lockout
  10. Multifactor Authentication (MFA)
  11. Phishing-Resistant MFA
  12. Passwordless Authentication
  13. Password Managers
  14. Conditional Access
  15. User & Entity Behavior Analytics (UEBA)
  16. Session Management
  17. Federation & Single-Sign On (SSO)
  18. Privileged Access Workstations (PAWs)

Domain 5: Network

  1. Default Credentials
  2. Local & Remote Network Infrastructure Management
  3. Wi-Fi Standards
  4. Wi-Fi Security Standards
  5. 802.1X
  6. MAC Authentication Bypass (MAB)
  7. Wireless Transmission Power
  8. Hidden SSID Broadcast
  9. Obscured Configuration Pages
  10. Wireless Access Schedule
  11. MAC Address Filtering
  12. Port Security
  13. DHCP Snooping
  14. Dynamic ARP Inspection (DAI)
  15. Network Address Translation (NAT)
  16. Network Firewalls
  17. Unified Threat Management (UTM) Systems
  18. Macrosegmentation
  19. Microsegmentation
  20. Demilitarized Zone (DMZ) for Public-Facing Systems
  21. Three Dumb Routers
  22. Honeynets & Honeypots
  23. Air-Gapped Network Segments
  24. Jumpboxes & Bastion Hosts
  25. Access Control Lists (ACL)
  26. Network Access Control (NAC)
  27. Comply to Connect (C2C)
  28. Software Defined Networking (SDN)
  29. Content Filtering & DNS Sinkholing
  30. Virtual Private Network (VPN)
  31. Proxy Servers
  32. Intrusion Detection & Prevention Systems (IDPS)
  33. Network Traffic Analysis (NTA)
  34. Backup Internet Service Provider (ISP)
  35. Etherchannel (Link Aggregation)
  36. Spanning Tree Protocol (STP)
  37. First Hop Redundancy Protocol (FHRP)
  38. Cisco IOS Hardening
  39. DNSSEC
  40. Email Security Gateway (SEG) & Spam Filters
  41. DMARC, DKIM, SPF
  42. Network Time Protocol (NTP)

Domain 6: Endpoint

  1. Operating System Selection & Licensing
  2. Enterprise Mobility Management
  3. Workgroups
  4. Active Directory (AD) Domains
  5. Mobile Device Management (MDM)
  6. Mobile Application Management (MAM)
  7. Baselines & Golden Images
  8. Zero Touch Provisioning (ZTP)
  9. Windows Hardening
  10. Linux Hardening
  11. Refresh Cycles
  12. Trusted Platform Module (TPM)
  13. Unified Extensible Firmware Interface (UEFI)
  14. UEFI Secure Boot
  15. Host Firewalls
  16. Host Intrusion Detection & Prevention Systems (HIDS/HIPS)
  17. Always-On VPN
  18. Anti-Malware Software
  19. Application Whitelisting
  20. Web Browser Protections
  21. Adblocking
  22. Cookies & Tracking Protection
  23. Full Disk Encryption (FDE)
  24. File Integrity Monitoring (FIM)
  25. Reboot to Restore
  26. Virtual Desktop Infrastructure (VDI)
  27. Endpoint Detection and Response (EDR) & Extended Detection and Response (XDR)

Domain 7: Data

  1. Encryption in Transit (TLS, IPSec, SSH, Tor)
  2. Encryption at Rest
  3. Public Key Infrastructure (PKI)
  4. Data Loss Prevention (DLP)
  5. Data Tokenization
  6. Data Labelling
  7. Data Watermarking
  8. File/Folder Encryption
  9. Redundant Array of Inexpensive Disks (RAID)
  10. Records Management & Archival
  11. eDiscovery
  12. Digital Rights Management (DRM)
  13. Media Sanitization & Data Destruction
  14. Steganography

Domain 8: Third Party, Cloud, and Supply Chain

  1. Shared Responsibility Models
  2. Service Level Agreements (SLAs)
  3. Security Clauses in Contracts
  4. Third Party Audit Requirements
  5. Cloud Migration Strategies
  6. Trusted Supplier Register
  7. Vendor Security Questionnaires
  8. Secure Attestations
  9. Annual Vendor Reviews
  10. Hardware Root of Trust
  11. Software Bill of Materials (SBOM)
  12. Code Signing
  13. Cloud Security Posture Management (CSPM)
  14. Cloud Access Security Broker (CASB)
  15. Security Access Service Edge (SASE)
  16. Secure Web Application & Software Development
  17. Content Delivery Networks (CDNs)
  18. Web Application Firewalls (WAF)
  19. Cloud Storage Security

Domain 9: Security Operations

  1. Updates & Patch Management
  2. Event Logging & Monitoring
  3. Security Information & Event Management (SIEM)
  4. Security Orchestration, Automation, and Response (SOAR)
  5. Ticketing Systems
  6. System Health Monitoring
  7. Spare Parts Plan & Inventory
  8. Artificial Intelligence (AI) Assistance in Cybersecurity
  9. Communication Channels
  10. Maintenance Windows & Blackout Periods
  11. Vulnerability Assessments & Management
  12. Penetration Testing
  13. Sandboxing & Application Virtualization
  14. Database Activity Monitoring (DAM)
  15. Forensic Investigations