Cybersecurity professionals are faced with the dilemma of selecting from a large set of cybersecurity defensive measures while operating with a limited set of resources with which to employ the measures. This report explains the menu of actions for defending an organization against cyberattack and recommends an approach for organizing the range of actions and evaluating cybersecurity defensive activities.