Section 15: Business continuity Section 16: Awareness and training Section 17: Communication Section 18: Testing in cybersecurity Section 19: Internal audit Section 20: Measuring, monitoring, and reporting performance and metrics Section 21: Continual improvement Section 22: Closing of the training course