NIST 800-53 classifies its controls into 5 main functions: -Identify. Includes Asset Management, Business Environment, Governance, Risk Assessment and Risk Management Strategy – and has been marked optional since these processes are described in the secondary & tertiary architectures and therefore rarely realised by mechanisms in the primary, run-time architecture. -Protect -Detect -Respond -Recover.