Organizes security measures into families of controls, such as assessment, access control, incident response, and others.