Designed to establish the baseline controls for the various levels of security necessary for government systems. Level 1: Foundational – basic cyber security practices with self assessment Level 2: Advanced – advanced cyber security practices with formal documentation Level 3: Expert – additional controls for preventing advance persistent threats.