Security frameworks divide an organization into seven domains. The value is not academic. It gives you a checklist so you can find the weak point instead of assuming the one product you bought has you covered.

1. The user domain

The people who use your systems. This is where most incidents begin, and it is addressed through training, clear policies and the habit of verifying unusual requests rather than acting on them.

2. The workstation domain

Laptops, desktops and phones. Controls here are endpoint protection, disk encryption, prompt patching and removing administrator rights from everyday accounts.

3. The LAN domain

Your internal network: switches, access points and cabling. Segmentation matters here. Guest Wi-Fi should not touch the network your accounting system runs on.

4. The LAN-to-WAN domain

The boundary between your network and the internet. Firewalls, intrusion detection and closing services that do not need to be exposed to the outside world.

5. The WAN domain

The connections between sites and out to the wider internet. Encryption in transit and properly configured VPNs for remote access.

6. The remote access domain

How staff reach your systems from outside the office. Multi-factor authentication is not optional here, and remote desktop exposed directly to the internet is one of the most reliably exploited weaknesses we encounter.

7. The system and application domain

Your servers, databases and business applications, along with the backups that protect them. Access control, patching and tested restores.

How to use this

Walk through the seven in order and ask what you have in place for each. Most businesses find they have invested heavily in two or three and left the others largely untouched. Attackers look for exactly that imbalance.