Security frameworks, explained
The laws, standards and control frameworks our lessons cite, in plain language: what each item asks for, what it looks like in practice, where organisations fall short, and how it connects to real incidents and the controls that help.
Laws and regulations
The EU regulation on personal data: lawful processing, people's rights, security of processing and breach notification. It applies to anyone processing personal data of people in the EU.
US rules for protecting health information: the Security Rule and the Breach Notification Rule.
Mandatory cybersecurity standards for the North American bulk electric system.
The EU regulation on AI systems by risk level, with requirements for high-risk systems and transparency duties.
The EU directive on cybersecurity for essential and important entities: risk-management measures in Article 21, incident reporting in Article 23 and personal accountability for management bodies.
The EU regulation on security requirements for products with digital elements, including vulnerability handling and software bills of materials.
The EU regulation on digital operational resilience for financial entities: ICT risk management, incident reporting, resilience testing and third-party risk.
The detailed technical and methodological requirements behind the NIS2 security measures for digital infrastructure and digital service providers.
Delegated Regulation (EU) 2024/1774, which details the ICT risk management framework DORA requires.
Control frameworks and standards
A prioritised set of 18 controls against the most common attacks, widely used as a practical security baseline.
The detailed catalogue of security and privacy controls used by US federal agencies and widely reused elsewhere.
Security outcomes organised in six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 (2024) reorganised several categories.
Open application security standards and guides: the Top 10, ASVS, SAMM and more.
Related international standards on privacy, incident management, business continuity, supplier security and AI management.
The international standard for an information security management system: clauses 4 to 10 set the management system requirements, Annex A lists the controls (93 in the 2022 edition).
The international series for securing industrial automation and control systems (OT).
Levels of assurance for how software artifacts are built, to protect the software supply chain.
The security standard for anyone who stores, processes or transmits payment card data, in 12 principal requirements.
Independent audit reports on a service provider's controls for security, availability, processing integrity, confidentiality and privacy.
The certification programme for US defence suppliers, largely based on NIST SP 800-171.
Eight baseline mitigation strategies with maturity levels.
Attacker knowledge bases
A public knowledge base of attacker tactics and techniques, used to plan detection and defence.
A knowledge base of attacks on AI and machine learning systems: prompt injection, jailbreaks, data poisoning and more.
A framework for planning adversary engagement: deception, denial and decoys.
Guidance, practices and programmes
Free, detailed NIST guides on specific topics: patching, incident response, supply chain risk, zero trust and more.
IT service management practices such as change, incident and problem management.
A voluntary framework for managing the risks of AI systems: Govern, Map, Measure and Manage.
A voluntary framework for managing privacy risk.
The Known Exploited Vulnerabilities catalog, binding directives and baseline performance goals.
A common language for cybersecurity work roles, tasks, knowledge and skills.