Layered Defense Architecture

Lesson 01 explained why management owns the risk. This lesson answers the next question an owner asks: what, exactly, are we supposed to have? The answer is a stack of controls arranged so that an attacker who beats one has to beat another. This lesson describes the stack and what it costs. The hands-on steps for each control are in the sibling modules, Securing Your Small Business Data and Systems for the office and cloud, and Securing Your Home Computer, Phone and Money for personal devices and remote workers. This lesson stays at the decision level and does not repeat their steps.

Why layers, and how many

The idea is called defense in depth, and it is old. A castle had a moat, a wall, a gate and a keep. The point was not that any one was unbreakable. The point was that an attacker had to win four fights in a row, and the defenders got time to react between them.

Modern attacks are a chain of steps, not one event. A criminal buys a stolen password, signs into email, reads for a week, sends a fake invoice to your accounts payable clerk and, if that fails, drops ransomware on the file server. Each step is a chance to stop the chain. A business with three layers that each stop 70 percent of what reaches them lets about 2.7 percent through, since 0.3 multiplied by itself three times is 0.027. A business with one layer stopping 90 percent lets 10 percent through. Those percentages are an illustration of why layers beat a single strong wall, not measured rates, and real layers are never fully independent. A stolen administrator password can defeat several layers at once, which is why identity gets its own layer and the most attention.

The NIST Cybersecurity Framework 2.0 (published February 26, 2024) organizes security outcomes in six functions: Govern, Identify, Protect, Detect, Respond and Recover. The CIS Critical Security Controls v8.1 list 18 controls, from asset inventory through penetration testing. The eleven layers below are a management view that maps onto both, so you can speak to an auditor in their language without handing your staff a 150-page standard.

The eleven layers

#	Layer	What it protects	Core controls for a business your size	Usual owner	CSF 2.0 function
1	Governance	The program itself	Named owner, written policies, risk register, board reporting, budget, vendor review	Owner or CEO, security lead	Govern
2	Identity and access	Accounts, the way most attackers get in	MFA everywhere, a password manager, least privilege, quarterly access review, separate admin accounts, fast offboarding	IT provider, HR for joiners and leavers	Protect
3	Endpoint	Laptops, desktops, servers, phones	Automatic patching, disk encryption, EDR, device management, no local admin rights for ordinary users	IT provider	Protect, Detect
4	Email and web	The channel for phishing and fraud	Filtering, link and attachment scanning, domain authentication records (SPF, DKIM, DMARC), banking-change call-back rule	IT provider, finance	Protect
5	Network	The path between systems and the internet	Business-grade firewall, patched edge devices, segmented guest and device networks, secured remote access, no open admin ports	IT provider	Protect
6	Data	The information itself	Classification, encryption at rest and in transit, access by need, retention limits, data loss controls for the most sensitive sets	Data owners, privacy lead	Protect
7	Application	Software you build or customize	Secure development practices, dependency updates, code review, tests before release	Whoever builds, or the vendor	Protect, Identify
8	Cloud and SaaS	Data in Microsoft 365, Google Workspace and other services	Secure configuration baselines, sharing limits, app approval, logging switched on, vendor review	IT provider, business owners	Protect, Identify
9	Monitoring	Early warning	Central logs, alert rules, EDR, someone who reads alerts at 2 a.m. (usually an MDR service)	Security lead, MDR provider	Detect
10	Response	What happens in the first hours	Written incident plan, contact list, roles, a practiced tabletop exercise, notification clock table	Security lead, executives	Respond
11	Recovery	Getting back to work	Immutable or offline backups, restore tests, recovery targets, alternate ways to take orders and pay staff	IT provider, operations	Recover

The eleven layers. Top bands prevent, middle bands limit damage and watch, the bottom bands respond and recover.

Layers 1 and 2 matter more than their place in a list suggests. Without governance, nobody maintains the rest, and without strong identity controls, an attacker walks around layers 3 through 8. Layer 11 is the one that decides whether a bad day becomes a business-ending one. CISA's #StopRansomware Guide (September 2023) recommends phishing-resistant MFA on email, VPNs and accounts that reach critical systems, offline encrypted backups that are tested regularly, and prompt patching with priority on internet-facing servers. Those three items map to layers 2, 11 and 3.

Zero trust, in plain words

The old model was a castle: everyone inside the office network was trusted, and the firewall kept strangers out. That broke when staff began working from home, using personal phones and storing files in cloud services. NIST SP 800-207, Zero Trust Architecture (August 2020) describes the shift: defenses move from fixed network perimeters to users, assets and resources, and trust is not granted automatically because of network location or because a device is company owned. Authentication and authorization happen before a session with a resource begins.

For a business without a security department, that comes down to these habits.

• Every sign-in uses MFA, whether the person is at a desk or on the road.
• Access to a file, system or application depends on the person's job, and expires or gets reviewed.
• The device is checked too: is it patched, encrypted and managed by the company? Many cloud tools can block sign-ins from devices that fail the check.
• Remote access goes to specific applications, not to the whole office network.
• Everything is logged, so you can answer who touched what.

CISA's Zero Trust Maturity Model Version 2.0 (April 2023) is written for federal agencies, but its structure is useful to anyone: five pillars (identity, devices, networks, applications and workloads, and data), three cross-cutting capabilities, and four maturity stages (Traditional, Initial, Advanced, Optimal). A company with 80 people does not need to hit "Optimal" in any pillar. It needs to know which stage it is in for each pillar and to move the weakest one first.

What each layer stops: the attack chain

MITRE ATT&CK is a public catalog of how attackers behave. Its Enterprise matrix organizes behavior into tactics, which are the attacker's goals at each stage. As of October 2026 the ATT&CK Enterprise tactics page (version 20) lists 15, from Reconnaissance to Impact. The list has changed over time. The current version shows Stealth and Defense Impairment where earlier versions had a single Defense Evasion tactic, so older training slides may show 14.

ATT&CK tactic (ID)	What the attacker is doing	Example in a 120-person firm	Layers most likely to stop or catch it
Reconnaissance (TA0043)	Gathering information on you	Collecting staff names and email format from the website and social media	Governance (data minimization on what you publish), Email
Resource Development (TA0042)	Building tools and infrastructure	Registering a look-alike domain, buying stolen credentials	Email (domain authentication, filtering), Identity (unique passwords, MFA)
Initial Access (TA0001)	Getting in	Phishing email, stolen password, unpatched internet-facing device	Identity, Email, Endpoint, Network, Cloud
Execution (TA0002)	Running malicious code	Staff open a booby-trapped attachment	Endpoint (EDR, application controls), Email
Persistence (TA0003)	Staying in	New hidden mail forwarding rule, new admin account, scheduled task	Monitoring, Identity (admin account alerts), Cloud logging
Privilege Escalation (TA0004)	Getting higher access	Using a shared local admin password to become domain administrator	Identity (least privilege, separate admin accounts), Endpoint
Stealth (TA0005)	Avoiding being seen	Running tools that blend in with normal administration	Monitoring, Endpoint (EDR)
Defense Impairment (TA0112)	Turning off the defenders	Disabling security software and deleting logs before encrypting	Endpoint (tamper protection), Monitoring (logs stored off the machine)
Credential Access (TA0006)	Stealing more passwords	Dumping saved passwords from a browser or server memory	Identity (MFA, password manager), Endpoint
Discovery (TA0007)	Looking around	Mapping file shares and finding where backups live	Network (segmentation), Monitoring
Lateral Movement (TA0008)	Moving to other systems	Using remote desktop from a phished PC to the file server	Network (segmentation), Identity, Monitoring
Collection (TA0009)	Gathering the target data	Zipping the HR share and the customer database	Data (access limits, encryption), Monitoring
Command and Control (TA0011)	Talking to the attacker's server	A hidden program checking in to an outside address	Network (outbound filtering), Monitoring
Exfiltration (TA0010)	Taking the data out	Uploading 40 GB to an outside storage service	Network, Data (loss controls), Cloud logging
Impact (TA0040)	Damage: encrypt, delete, extort, defraud	Ransomware on servers, or a fraudulent wire	Recovery (immutable backups), Response, Email and finance call-back rule

The table matters for a simple reason. If every control you own acts at Initial Access, one slip loses everything. A layered stack also has controls that make the later stages hard (Privilege Escalation through Exfiltration) and controls that make the final stage survivable (Impact). Verizon's 2026 DBIR reports that exploiting vulnerabilities is now the most common way in, at 31 percent of breaches, and that third parties were involved in 48 percent. That reads as a case for patching discipline and for vendor control, which are layers 3 and 1.

Maturity: where are we, and what comes next

NIST CSF 2.0 describes four Tiers that characterize the rigor of governance and risk management: Partial, Risk Informed, Repeatable and Adaptive. The tiers are optional, and an organization uses them to inform its target profile. For a business, a four-step scale that mixes the CSF tiers with common sense is easier to use.

Level	How it looks	Typical evidence	Next move
1. Ad hoc (CSF: Partial)	Security depends on one helpful person. No policies, backups untested, MFA on some accounts.	Nothing written	Turn on MFA, fix backups, name an owner
2. Defined (CSF: Risk Informed)	Policies exist, basic controls cover most systems, risks discussed but not tracked.	Policy set, asset list, patch report	Start a risk register, test a restore, add EDR
3. Managed (CSF: Repeatable)	Controls are checked on a schedule, metrics reach management, incidents are practiced.	Quarterly reports, tabletop record, access reviews	Add monitoring by an MDR service, pursue an outside assessment
4. Optimized (CSF: Adaptive)	Program adjusts to new threats, outside assurance is routine, risk is part of strategic planning.	Audit report or certification, board dashboard	Keep it funded. Most firms under 500 never need more than this.

CIS offers a more specific ladder with its Implementation Groups. IG1 is described as "essential cyber hygiene" that every enterprise should start with, IG2 builds on it and IG3 includes all controls. The CIS Controls v8 and v8.1 contain 153 safeguards in total. Lesson 04 gives the counts and a chooser for the frameworks.

The minimum viable stack by company size

Do not expect precise prices. Vendor quotes vary by region, contract length and what a company already owns. Where a price appears below with a link, it is a list price read from the vendor's page in October 2026. The rest are the author's rough planning ranges for 2026 and should be treated as starting points for budgeting, not as quotes. Get at least two quotes before committing.

Layer	10 to 25 people	25 to 100 people	100 to 500 people
Governance	Owner named as accountable. One-page policy set. Annual review.	Security lead named. Risk register. Quarterly management review. Vendor list.	Security lead or vCISO. Board reporting. Framework chosen and assessed. Internal or external audit.
Identity	MFA on email, banking, payroll, admin. Password manager. Admin accounts separate.	Same, plus single sign-on for main apps, quarterly access review, phishing-resistant MFA for admins.	Same, plus conditional access, privileged access management, automated joiner-mover-leaver.
Endpoint	Auto-updates, disk encryption, built-in or bundled antivirus plus device management.	EDR on all devices. Managed patching. Mobile device management.	EDR with MDR. Application control on servers. Vulnerability scanning.
Email and web	Vendor filtering, SPF/DKIM/DMARC set to enforce.	Add link rewriting, attachment sandboxing, banking-change call-back rule.	Add impersonation protection, DNS filtering, brand monitoring.
Network	Business-grade firewall, patched, separate guest Wi-Fi.	Segmented networks, VPN or zero trust access for remote staff.	Segmentation by function, network monitoring, tested firewall rules.
Data and cloud	Know where customer and employee data live. Sharing limits in cloud storage.	Data inventory, classification, retention schedule, cloud configuration review.	Data loss controls, tokenization where possible, formal data governance.
Monitoring and response	Cloud audit logs on. Written one-page incident card. Phone numbers for insurer and IT.	MDR service. Incident plan. Annual tabletop.	MDR plus a log platform, retained forensic support, two tabletops a year.
Recovery	3-2-1 backups, one copy offline or immutable, restore test twice a year.	Immutable backups for key systems, defined recovery targets, restore tests quarterly for critical systems.	Tiered recovery plans, alternate site or cloud recovery, business impact analysis.

Cost anchors, sourced and rough

Item	Figure	Status
Microsoft 365 Business Premium (email, identity, Defender for Business and Intune device management bundled; 300-user limit)	$22.00 per user per month with Teams, $18.79 without, billed yearly	Sourced: Microsoft's product page, October 2026
CrowdStrike Falcon Go (Security Essentials, capped at 100 devices)	$59.99 per device per year	Sourced: vendor pricing page, October 2026
CrowdStrike Falcon Pro (Enhanced Protection)	$99.99 per device per year	Sourced: same page
CrowdStrike Falcon Enterprise (Advanced Protection)	$184.99 per device per year	Sourced: same page
Managed detection and response, per endpoint	Roughly $8 to $20 per endpoint per month	Rough planning range by the author. Falcon Complete shows "Contact sales" and no price on the vendor page.
Password manager	Roughly $3 to $8 per user per month	Rough
Security awareness training	Roughly $2 to $5 per user per month	Rough
Immutable cloud backup, small business	Roughly $2,000 to $15,000 a year depending on data volume	Rough
vCISO service	Roughly $1,500 to $6,000 a month for a few hours of leadership time	Rough
External penetration test	Roughly $8,000 to $30,000 for a small environment	Rough

Reading your own stack: a decision table

If you find this	The gap is in layer	First fix	Owner and timeframe
Some staff sign in with only a password	2 Identity	Enforce MFA; stop legacy sign-in methods that skip it	IT provider, 30 days
Backups are on a drive attached to the server	11 Recovery	Add an offline or immutable copy and run a test restore	IT provider, 60 days
No one can say how many devices we own	1 Governance, 3 Endpoint	Build an asset list (Lesson 03)	Security lead, 45 days
Alerts go to an inbox nobody checks after 5 p.m.	9 Monitoring	Contract an MDR service or set up paged on-call	Security lead, 90 days
Vendors hold customer data under no written security terms	1 Governance	Start a vendor register and contract review (Lesson 09)	Business owners, 90 days
No written plan for the first hour of an incident	10 Response	One-page incident card with calls to make (Lesson 11)	Security lead, 30 days

Questions and answers

Which layer should we build first?

Identity and recovery, in that order. Stolen credentials are the common way in, and a recoverable business survives even when prevention fails. Governance runs alongside from day one: you need an owner before you need a product.

We are a 20-person firm. Do we really need all eleven layers?

You need all eleven covered, but not with eleven products. The small-company column in the table shows the scale: Layers 2, 3, 4 and 8 can sit largely inside one productivity suite, and layers 10 and 11 are mostly paper and a tested backup.

Is a managed security service worth the money?

If nobody on your team will read alerts at 2 a.m., yes. The cost arithmetic in the Northgate example puts MDR at $12,960 a year for 90 endpoints at an assumed rate. IBM's 2026 report, as summarized by a trade publication (eSecurityPlanet), says organizations making extensive use of security AI and automation had an average breach cost $1.93 million lower. That is a large-company average and it covers automation broadly rather than MDR services specifically, but it points the same direction.

What is the difference between NIST CSF and the CIS Controls?

The CSF is a framework of outcomes in six functions. The CIS Controls are a prioritized list of specific safeguards, 153 in v8.1. Many firms use the CSF to organize and the CIS list to decide what to do. Lesson 04 compares them.

Do we need a separate zero trust product?

No. Zero trust is a way of deciding access. The practical steps are MFA, device checks, least privilege and access to specific apps, and many are included in suites such as Microsoft 365 Business Premium.

How do these layers connect to the home and small office modules?

The home module covers personal devices and travel. The small business module covers accounts, backups, email, phones and the incident playbook. This lesson is the management map above both, and Lessons 10 through 12 add people, response and recovery planning at the program level.

Should we choose our own tools or let the IT provider choose?

The provider can recommend tools, but management should own the standard they are held to. Put the standard in writing, such as "MFA on all accounts, EDR on all devices, immutable backups," and then let the provider show how they meet it.

Hard questions

"We already have antivirus and a firewall. Why spend more?"

Because the frequent attack routes bypass both. Verizon's 2026 data puts exploited vulnerabilities, often in unpatched internet-facing devices, as the leading way in. Stolen credentials and phishing, which IBM's summary calls the most common starting point for the fourth straight year, get past antivirus and firewalls by being legitimate-looking sign-ins. The extra spending covers the routes those two tools do not see.

"Show me proof that layers work, instead of vendors' marketing."

The 70-percent illustration in this lesson is arithmetic, not evidence, and you should not treat it as a measured rate. Better evidence is structural. The FTC's Start with Security guide, built from its enforcement cases, lists failures that combine: no access limits, weak authentication, no monitoring, untested vendors. CISA's ransomware guide ties its advice to what attackers do. Test your own layers instead: simulate a stolen password and see what stops it.

"We cannot afford $78,000 a year."

Then do the first tier of the plan and say plainly what is deferred. The sourced cost of the bundle in the example is $22,440, and much of the first-year benefit comes from turning on controls you may already own. What you cannot do is skip the decision. Record what is not funded, who accepted that, and the date to revisit it, using the risk acceptance process in Lesson 03.

"Our staff will bypass the controls because they slow work."

Some will, and the answer is design, not scolding. Single sign-on reduces password friction, device-based rules cut the number of MFA prompts, and a documented exception route keeps people from building their own. Lesson 10 covers policies and training that people follow.

"If zero trust is a principle and not a product, how do we know we have it?"

Use the five pillars as a checklist and mark each Traditional, Initial, Advanced or Optimal. If you can answer for each pillar, who can reach what, from which device, with what check and what record, you have a defensible position. If you cannot, that is where to start.

Next, Lesson 03 shows how to find out which assets and data these layers must protect, and how to rank the risks in a register.