1.3 Evaluate, apply, and sustain security governance principles.

• 1.3.1 Alignment of the security function to business strategy
• 1.3.2 Organizational processes (e.g., acquisitions, divestitures, etc.,)
• 1.3.3 Organizational roles and responsibilities
• 1.3.4 Security Control Frameworks
• 1.3.5 Due Care and Due Diligence