This involves identifying an organization’s  critical functions and what cybersecurity risks could impede those functions.  The function covers different categories, such as the business environment, which refers to the organization’s objectives, activities, and stakeholders, and asset management, the systems, data, devices, facilities, and employees needed to achieve a critical function.

This focuses on containing a cybersecurity breach’s potential impact. Once critical functions are identified, businesses can prioritize them and subsequently prioritize their cybersecurity efforts.. This function defines the safeguards a business must have in place to make sure that critical functions and their relevant components, such as employees, systems are safe. There are 6  steps:

1) limit access to compromised assets,

2) educate the organization's personnel,

3) manage the company's information according to a defined risk strategy,

4) use security procedures to protect the organization's systems and data,

5) perform necessary maintenance and repairs, and

6) make use of protective technology solutions.

This function’s aim is to assess whether a company’s systems are compromised so that action can be taken if needed. The function analyzes how the organization’s cybersecurity team determines a breach has happened.

If a breach is detected, the IT Dept must respond to it quickly. The longer a cyberattack continues, the more damage critical functions may be exposed to.

The respond function aims to minimize damage and downtime  by promoting a rapid response. It outlines the actions that the IT Dept can and should perform depending on the cybersecurity breach’s severity and type.

The recover function aims to get back any data that might have been lost as a result of a breach or attack. It also deals with restoring services to critical systems that may have been damaged because of the cyber attack. It  provides a chance to identify what activities will support the organization's cybersecurity infrastructure resilience in the future.

In addition to recovery planning and determining where improvements can be made, the recover function also requires communicating with both internal and external stakeholders (for example, employees and customers) regarding the incident.