1. Identify — asset & risk inventory
2. Protect — access control & MFA
3. Detect — monitoring & logging
4. Respond — incident response plan
5. Recover — backups & recovery
6. Govern — leadership engagement
7. Third parties — supplier risk
8. Continuity — digital dependency