A layered approach is better because every single control has a failure mode it cannot detect by itself. Encryption does nothing when an attacker holds valid credentials. Backups do not stop exfiltration. Covering the full cycle of finding, protecting, detecting, responding and recovering means one gap does not become a breach.
What does "comprehensive" actually mean?
It does not mean buying more tools. It means your program answers each of these questions, and someone owns the answers.
NIST's Cybersecurity Framework 2.0 organizes outcomes into functions: Govern, Identify, Protect, Detect, Respond and Recover. The CSF is a voluntary framework, and NIST publishes profiles and quick start guides for turning it into a plan. A data program maps to the same shape.
- Govern: who decides what is acceptable, and who answers for it.
- Identify: what data you hold and where.
- Protect: access limits, encryption, secure configuration.
- Detect: alerts for unusual access or movement.
- Respond and recover: containment, notification, restoring from known good copies.
Why does one control fail alone?
Walk through a constructed case. A company encrypts its customer database at rest and considers it done. An engineer's laptop is compromised and the attacker uses the engineer's session. The database decrypts transparently for that session, because that is how encryption at rest works. The data walks out through an allowed account.
Which layers would have helped? Identify would have shown the laptop could reach production data. Protect, in the form of narrower access, would have limited what the session saw. Detect would have flagged an export of unusual size. Recover is not relevant to theft, which is the point: no single layer covers every event type.
NIST's NCCoE guide SP 1800-28 on data confidentiality makes the same case at length for data breaches, pairing asset identification, protection and detection, and showing example technologies for each.
What does the evidence say about coverage?
Be wary of any statistic that claims a specific percentage of breaches are prevented by a given control. Those numbers vary by method and year. A safer argument is structural: map your last three incidents to the functions above and look at which layer would have stopped each. Most teams find the gap was in Identify or Detect, the unglamorous layers.
How do you prioritize the layers?
Start from the data, not the tool catalog. Rank your stores by what a leak would cost: regulated personal data, credentials and secrets, contracts, source code, internal chatter. Apply the full set of layers to the top few, and a lighter set to the rest.
Then ask three questions of each top store. Could we tell within a day if someone copied it out? Could we restore it to a known good state? Could we say who had access last Tuesday? A no to any of these marks a gap worth closing before you add a new protective control.
Governance is the layer most often skipped because it produces no alerts. It decides who accepts a risk, how exceptions expire, and who reports to leadership. Without it the other layers drift. An exception granted for a migration in January becomes permanent by June unless someone owns its end date.
How to check or apply this
- Draw a table with the six CSF functions as rows and your data stores as columns.
- Fill each cell with the control that applies and its owner. Blank cells are your backlog.
- Check for single points of failure: any store protected by a single control.
- Test detection. Copy a harmless test file out of a sensitive store and see whether anything alerts.
- Test recovery. Restore one dataset from backup and time it.
- Review after every incident and every large system change.
- Use a CSF profile to record the target state and the current state side by side.
A layered approach has a cost: more controls to run and more alerts to read. Weigh that. Two overlapping controls with no owner are worse than one with a clear owner.
Quick check
Is layered security the same as defense in depth?
Close. Defense in depth is the older phrase for stacking independent protections. The CSF framing adds governance, response and recovery, which a purely protective stack leaves out.
Does a framework like CSF 2.0 have to be followed in full?
No. NIST describes it as voluntary guidance. Use it as a checklist for coverage and tailor the depth to your risk.
Sources
- NIST Cybersecurity Framework
- NIST SP 1800-28: Data Confidentiality, Identifying and Protecting Assets Against Data Breaches
Last reviewed: 18 October 2026.
