Technical measures

• Identity and access management (IAM) is in place.
• Sensitive data is encrypted at rest and in transit.
• Security monitoring (SOC/SIEM or equivalent) is deployed.
• Regular, tested backups are in place.
• Development and production environments are secured.
• Vulnerabilities are patched regularly (patch management).
• Networks are segmented according to system criticality.
• The business continuity plan is documented and tested.

← Previous phase: Governance