Frameworks & standards

ISO, NIST, Cyber Essentials and the rest. What they actually ask for.

15 sketches

• CAPECThe knot, not the rope
• CIS ControlsStart at the bottom
• CWEThe drawing, or one house
• Cyber EssentialsA five bar gate
• ISO 27001Read the scope, not the certificate
• MITRE ATT&CKA field guide, not a battle plan
• NIST CSFThe Framework names the shelves
• OWASP API Top 10Change the number, get the parcel
• OWASP Top 10The board at the trailhead
• SSDFThe card names the loaf, not the oven
• BenchmarkingEverybody is in the same water
• Control cataloguesOne extinguisher, four names
• Maturity modelsThe gauge is on the gap
• Threat modelling frameworksFour gates, whatever the method
• Zero trust architectureBeing inside stopped counting