The framework encompasses various security controls across its five core functions: Identity, Protect, Detect, Respond, and Recover. These controls include access controls, encryption, intrusion detection systems (IDS), incident response plans, data backup, vulnerability assessment, and more. Each function comprises multiple categories and subcategories, offering a comprehensive approach to managing cybersecurity risks.