MITIGATIONS

Enterprise

Account Use Policies

Active Directory Configuration

Antivirus/Antimalware

Application Developer Guidance

Application Isolation and Sandboxing

Audit

Behavior Prevention on Endpoint

Boot Integrity

Code Signing

Credential Access Protection

Data Backup

Data Loss Prevention

Disable or Remove Feature or Program

Do Not Mitigate

Encrypt Sensitive Information

Environment Variable Permissions

Execution Prevention

Exploit Protection

Filter Network Traffic

Limit Access to Resource Over Network

Limit Hardware Installation

Limit Software Installation

Multi-factor Authentication

Network Intrusion Prevention

Network Segmentation

Operating System Configuration

Out-of-Band Communications Channel

Password Policies

Pre-compromise

Privileged Account Management

Privileged Process Integrity

Remote Data Storage

Restrict File and Directory Permissions

Restrict Library Loading

Restrict Registry Permissions

Restrict Web-Based Content

Software Configuration

SSL/TLS Inspection

Threat Intelligence Program

Update Software

User Account Control

User Account Management

User Training

Vulnerability Scanning

Mobile

Antivirus/Antimalware

Application Developer Guidance

Attestation

Deploy Compromised Device Detection Method

Do Not Mitigate

Encrypt Network Traffic

Enterprise Policy

Interconnection Filtering

Lock Bootloader

Security Updates

System Partition Integrity

Use Recent OS Version

User Guidance

ICS

Access Management

Account Use Policies

Active Directory Configuration

Antivirus/Antimalware

Application Developer Guidance

Application Isolation and Sandboxing

Audit

Authorization Enforcement

Boot Integrity

Code Signing

Communication Authenticity

Data Backup

Data Loss Prevention

Disable or Remove Feature or Program

Encrypt Network Traffic

Encrypt Sensitive Information

Execution Prevention

Exploit Protection

Filter Network Traffic

Human User Authentication

Limit Access to Resource Over Network

Limit Hardware Installation

Mechanical Protection Layers

Minimize Wireless Signal Propagation

Mitigation Limited or Not Effective

Multi-factor Authentication

Network Allowlists

Network Intrusion Prevention

Network Segmentation

Operating System Configuration

Operational Information Confidentiality

Out-of-Band Communications Channel

Password Policies

Privileged Account Management

Redundancy of Service

Restrict File and Directory Permissions

Restrict Library Loading

Restrict Registry Permissions

Restrict Web-Based Content

Safety Instrumented Systems

Software Configuration

Software Process and Device Authentication

SSL/TLS Inspection

Static Network Configuration

Supply Chain Management

Threat Intelligence Program

Update Software

User Account Management

User Training

Validate Program Inputs

Vulnerability Scanning

Watchdog Timers