Adequate measures are protections that are sufficient for the specific risk, data type, system, and operating context. The term does not mean “maximum security”; it means the controller or operator has chosen controls that are proportionate, defensible, and effective for the threat model at hand. In practice, adequacy is judged by factors such as sensitivity of the data, likelihood of attack, available technology, and the cost and impact of the controls.
In cyber security, adequate measures are the difference between a policy and real protection. They can include access control, encryption, logging, backups, patch management, network segmentation, and incident response procedures. Attackers exploit gaps where controls are absent, weak, or outdated; defenders use the adequacy standard to show that security decisions were deliberate and matched the risk. Because “adequate” is context-dependent, it is often evaluated during audits, investigations, and legal reviews of whether an organization met its protection duty.