— GOVERN IDENTIFY PROTECT DETECT RESPOND RECOVER

— Organizational Context Risk Management Strategy Roles, Responsibilities, and Authorities Policies, Processes, and Procedures Oversight Cybersecurity Supply Chain Risk Management Asset Management Risk Assessment Improvement Identity Management, Authentication, and Access Control Awareness and Training Data Security Platform Security Technology Infrastructure Resilience Continuous Monitoring Adverse Event Analysis Incident Management Incident Analysis Incident Response Reporting and Communication Incident Mitigation Incident Recovery Plan Execution Incident Recovery Communication

— 1st Party Risk 3rd Party Risk 1st & 3rd Party Risk