NIST CSF

The Cybersecurity Framework organises security outcomes into a handful of functions: govern, identify, protect, detect, respond and recover.

Its value is as a shared structure rather than a checklist. It gives a board and an engineer a common vocabulary and makes gaps visible, particularly the chronic under-investment in detect and recover relative to protect. It tells you what to have, not how to build it.