prescriptive approach and provides ongoing documentation of activities that
organizations should perform to enhance security. Some of the 30 key activities
include the following:
u Monitor security metrics