Having plans and mechanisms in place to prevent, detect, and respond to cyber or physical security threats

and the security of the system and its content