are generally applicable and usable by a wide range of qualifying institutions;

vary with the nature and size of the qualifying institutions, and the nature and sensitivity of the data collected or stored on the information systems or devices of the qualifying institutions;

include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist qualifying institutions in mitigating common cybersecurity risks;

include case studies, examples, and scenarios of practical application;

are outcomes-based and can be implemented using a variety of technologies that are commercial and off-the-shelf; and

to the extent practicable, are based on international technical standards.