M1040Behavior Prevention on Endpoint
Block common attack behaviors using Defender ASR rules and Office macro restrictions.
ZT: assume breachEDR / Attack Surface ReductionWindowsLinuxmacOS
TA0040Defense Plan
Impact
Damaging integrity/availability
Business Continuity and Disaster Recovery (BCP/DR)
Tested business continuity and disaster recovery plans for all critical systems (NIST SP 800-34); recovery is 30% faster with a tested BCDR.
BCP/DR / RTO-RPOWindowsLinuxCloud
M1053Data Backup
The most critical control against ransomware/destructive attacks: regular, tested, offline/immutable backups.
ZT: assume breachBackup & Recovery PolicyWindowsLinuxmacOSCloud
M1041Encrypt Sensitive Information
Encrypting sensitive data at rest and in transit so it cannot be used even if stolen.
ZT: assume breachEncryption PolicyWindowsLinuxmacOSCloudNetwork
M1029Remote Data Storage
Resilience against single-point loss by storing critical data and backups offsite, within a separate trust boundary.
ZT: assume breachOffsite/Cloud StorageCloudWindowsLinux