Sharing Indicator : White Essential Cybersecurity Controls Subdomains Figure (2) below shows the ECC subdomains 1. Cybersecurity Governance 1-1 Cybersecurity Strategy 1-2 1-3 Cybersecurity Policies and Procedures 1-4 1-5 Cybersecurity Risk Management 1-6 1-7 2. Cybersecurity Defense Compliance with Cybersecurity Standards, Laws and Regulations 1-8 Cybersecurity Management Cybersecurity Roles and Responsibilities Cybersecurity in Information and Technology Project Management Periodical Cybersecurity Review and Audit Cybersecurity Awareness and 1-9 Cybersecurity in Human Resources 1-10 2-1 Asset Management 2-2 Identity and Access Management 2-3 Information Systems and Information Processing Facilities Protection 2-4 Email Protection 2-5 Network Security Management 2-6 Mobile Devices Security 2-7 Data and Information Protection 2-8 Cryptography 2-9 Backup and Recovery Management 2-10 Vulnerability Management 2-11 Penetration Testing 2-12 Cybersecurity Event Logs and Monitoring Management 2-13 Cybersecurity Incident and Threat Management 2-14 Physical Security Training Program 2-15 Web Application Security 3. Cybersecurity Resilience 3-1 Cybersecurity Resilience Aspects of Business Continuity Management (BCM) 4. Third-Party and Cloud Computing Cybersecurity 4-1 5. ICS Cybersecurity 5-1 Third-Party Cybersecurity Cloud Computing and Hosting Cybersecurity Industrial Control Systems and Devices (ICS) Protection Figure (2): ECC Subdomains 12 4-2 Document Classification: Unclassified