The framework covers identification, protection, detection, response, recovery and learning for all ICT assets. Management is responsible for approving and overseeing the framework. It must be documented, reviewed at least yearly and after major incidents.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Keep an inventory of ICT assets and their dependencies
- Define protection and detection measures for critical functions
- Review the framework every year and after major incidents
Making it stick
Many firms already have parts of this in place. The work is often to connect them into one framework with clear ownership. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.