documentation Controls

A cybersecurity policy is established, approved, and communicated

An incident response plan is documented and maintained

Maintain written security policies, procedures, and records for six years from creation or last effective date

The end of incident recovery is declared based on criteria, and incident-related documentation is completed

Security information is communicated internally

Control activities are selected and developed to mitigate risks

Controls are deployed through policies and procedures