Provide 20 examples of security measures that you can implement for those subcategories. Remember to indicate if the security measure is preventative, Detective, or Corrective. Provide at least 4 security measures per (Admin/Physical/Technical).

Access Control (PR.AC):

Subcategories:

1. Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes.

2. Physical access to assets is managed and protected.

3. Remote access is managed.

4. Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.

5. Network integrity is protected (e.g., network segregation, network segmentation).

6. Identities are proofed and bound to credentials and asserted in interactions.

7. Users, devices, and other assets are authenticated (e.g., single-factor, multi-factor) commensurate with the risk of the transaction (e.g., individuals security and privacy risks and other organizational risks).

Awareness and Training (PR.AT):

Subcategories:

1. All users are informed and trained.

2. Privileged users understand their roles and responsibilities.

3. Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities .

4. Senior executives understand their roles and responsibilities.

5. Physical and cybersecurity personnel understand their roles and responsibilities.