ABSTRACT
The three-level control framework (TLCF) is intended to replace information security standards or any other inventory or benchmark of good practices. A questionnaire that facilitates brainstorming can be made using recommendations from the standards, the regulations, the requirements of a maturity model, or any other document or study that deals with security governance good practices. The primary purpose of this standard is to identify all essential operational controls in the field of cyberdefense. Governance and management practices can be schematized by applying the TLCF template to either an entire IS management system or a specific security domain. The template of the TLCF model makes such introspection possible and facilitates the task of identifying major points to improve. Cybersecurity posture can be the subject of self-assessing governance practices to ensure that operational controls benefit from all the necessary governance and management support: strategy, policies, organization, risks, program, asset management, compliance, metrics, and reporting.
