Having plans and mechanisms in place to prevent, detect, and respond to cyber or physical security threats

Planning sufficiently for risk mitigation, business continuity, disaster recovery, and succession.