Assess what is happening and ability to implement controls to mitigate.
Assess what is happening and take measure to contain, mitigate and recover.
Protect information and information systems from threats implementing controls to preserve:
Confidentiality > Integrity > Availability