# The six CyFun functions, in terms everyone can understand

> Govern, Identify, Protect, Detect, Respond and Recover. What each one means.

CyFun organizes security into six functions. Together they cover the entire risk life cycle, from understanding what you have to protect to recovering after an incident. Think of them as six questions to which a mature organization always knows the answer.

  
### Govern: who is accountable and under what rules

  This is the foundation. Here you establish who is responsible for security, what policies exist, how you make risk decisions and how you manage suppliers. The management approves and oversees, and the roles are clear. Concrete examples: an approved information security policy, a risk management process, security requirements in supplier contracts.

  
### Identify: what you have to protect

  You cannot protect what you do not know you have. Here you inventory the hardware and software assets, the data and its classification, the critical suppliers and the network flows, then you identify the vulnerabilities and assess the risks. Examples: an up-to-date asset inventory, a risk register, a list of suppliers with their assessment.

  
### Protect: the measures that reduce risk

  This is the most visible part. Access control on the "need to know" and "least privilege" principles, multi-factor authentication, encryption of sensitive data, hardening of configurations, patch management, backups and staff training. Many security events are stopped here, before they become incidents.

  
### Detect: noticing in time

  Even with good protection, some things go unnoticed. Detection means monitoring, logging and alerting, so that you quickly identify abnormal activity. Examples: collection and analysis of logs, alerts for suspicious logins, monitoring of the perimeter and of the equipment.

  
### Respond: what you do when it happens

  A well-handled incident costs and impacts much less than one for which you have no measures in place. Here you have the response plan, the roles, the internal and external communication, as well as the reporting to DNSC within the required deadlines. Examples: an incident management procedure, playbooks for frequent scenarios, notification forms prepared in advance.

  
### Recover: how you return to normal

  After you isolate or eliminate the incident, you have to resume activity. Recovery covers the continuity and disaster recovery plans, the time and data objectives (RTO and RPO), the testing of backup restoration and the lessons learned, which support the other functions in the recovery process.