Area #2: Adoption of a Cybersecurity Policy The policy must cover several areas, including but not limited to access controls, business continuity, third-party provider management, and security incident response.