1

Foundation

Identity, governance, and baseline hygiene

2

Control

Just-in-time access, approval workflows, and policy

3

Isolation

PAWs, tiering, network segmentation, and boundary enforcement

4

Operations

Secure admin processes, break glass, and operational discipline

5

Validation

Continuous monitoring, audit, and evidence-based assurance