Defines decision rights, policies, standards, exceptions, ownership, funding, reporting lines, and oversight for an accountable cybersecurity program.
