We have defined controls across all four phases: prevention, detection, response, and recovery.
Identity protection (MFA, privileged access) is treated as the highest priority control layer.
We have tested our incident response plan in the last 12 months — not just documented it.
Our backups have been verified — we know how fast we can recover and have tested it.