See The WholeSecurity Picture.

Use Professional Ethics in Cybersecurity to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Understanding and Applying Security Concepts to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Security Governance Principles to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Legal, Regulatory, and Compliance Issues to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Risk Management Concepts to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Threat Modeling and Vulnerability Assessments to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Security Policies, Standards, Procedures, and Guidelines to evaluate governance, ethics, legal exposure, risk ownership, and policy choices before choosing controls.

Use Asset Ownership and Protection Responsibilities to protect data by tying classification, ownership, retention, privacy, and handling to business value.

Use Retention, Handling, and Disposal of Assets to protect data by tying classification, ownership, retention, privacy, and handling to business value.

Use Data Security Controls and Compliance Requirements to protect data by tying classification, ownership, retention, privacy, and handling to business value.

Use Supply Chain Risk Management to protect data by tying classification, ownership, retention, privacy, and handling to business value.

Use Asset Security Review and Governance to protect data by tying classification, ownership, retention, privacy, and handling to business value.

Use Engineering Processes Using Secure Design to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Secure Models, Architectures, and Evaluation to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Vulnerabilities in Systems and Components to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Cryptography and Symmetric Key Management to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use PKI and Cryptographic Applications to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Site and Facility Security Design to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Hardware Security and Embedded Systems to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Security Architecture Review and Resilience to evaluate secure architecture, cryptography, resilience, and design tradeoffs at an advanced level.

Use Network Architecture and Secure Design to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Secure Network Components and Technologies to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Transmission Security and Protocol Protection to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Network Attacks and Defensive Controls to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Secure Communication Channels to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Remote Access and Perimeter Protection to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Cloud and Virtual Network Security to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Communication Security Operations to make network and communication security choices across segmentation, remote access, monitoring, and trust boundaries.

Use Identity and Access Management Foundations to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Access Control Models and Mechanisms to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Authentication Systems and Credentials to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Federation, SSO, and Identity Services to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Authorization and Privileged Access to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Identity Governance and Lifecycle to manage identity, authentication, authorization, privileged access, and access lifecycle choices.

Use Security Assessment and Testing Foundations to turn testing, audits, vulnerability findings, and metrics into action that leadership can defend.

Use Test Strategies and Validation Methods to turn testing, audits, vulnerability findings, and metrics into action that leadership can defend.

Use Security Audits and Compliance Reviews to turn testing, audits, vulnerability findings, and metrics into action that leadership can defend.

Use Collecting Security Process Data to turn testing, audits, vulnerability findings, and metrics into action that leadership can defend.

Use Testing Reports and Continuous Improvement to turn testing, audits, vulnerability findings, and metrics into action that leadership can defend.

Use Security Operations Foundations to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Incident Response and Investigations to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Disaster Recovery and Business Continuity to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Logging, Monitoring, and Detection to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Resource Protection and Operational Controls to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Physical Security and Safety to lead operational choices across monitoring, response, investigations, recovery, and evidence handling.

Use Software Development Security Foundations to apply secure development knowledge across requirements, design, testing, deployment, and software risk.

Use Application Security Controls and Testing to apply secure development knowledge across requirements, design, testing, deployment, and software risk.

Use Software Security Vulnerabilities and Countermeasures to apply secure development knowledge across requirements, design, testing, deployment, and software risk.