Internal programs that fall within the guidance of the framework include access management, vulnerability management, incident response, business continuity planning, malware defense, email and web filtering, intrusion detection, testing and training programs for employees.