Developing and supporting an information security program is a continual that is revised over time.  Our approach begins with evaluating the current IS program, identifying gaps, determining mitigations, implementing improvements, and creating the ongoing continuous management process.  "Core" Framework practices are composed of five concurrent and continuous functions—Identify, Protect, Detect, Respond, and Recover—that provide a strategic view of the lifecycle of an organization’s management of cybersecurity risk.  Each function is further divided into categories tied to programmatic needs and particular activities.  In addition, each category is broken down into subcategories that point to informative references.