Security Frameworks & Standards
A curated reference of the frameworks, methodologies, and standards that structure modern security programs — from governance and risk to offensive testing, defense, compliance, and AI security.
What Are Security Frameworks?
A security framework is a structured set of guidelines, controls, and best practices that an organization uses to manage risk and protect assets. They fall into a few families:
Governance & Risk
How leadership sets security strategy, measures risk, and allocates resources.
Attack Frameworks
How adversaries operate — used to model threats and prioritize detection.
Testing Methodologies
How to test systems systematically for vulnerabilities.
Defensive Controls
What specific safeguards to implement and measure.
Compliance
Legally or contractually mandated requirements.
AI Security
Frameworks specific to securing AI/ML systems.
How to Choose a Framework
You rarely pick one framework — you layer a governance framework, a control set, and a compliance standard together.
- Start with governance. Adopt NIST CSF (flexible, free) or ISO 27001 (certifiable) to define your program structure.
- Pick a control catalog. Map your program to CIS Controls (practical, prioritized) or NIST SP 800-53 (comprehensive, US federal).
- Model threats. Use MITRE ATT&CK to understand adversaries and validate your detections against real techniques.
- Test continuously. Apply OWASP WSTG/ASVS for applications and PTES for network pentests.
- Meet obligations. Add PCI DSS (if you handle cards), HIPAA (healthcare), GDPR (EU data), SOC 2 (SaaS).
- Secure AI. If you build or deploy AI, layer NIST AI RMF and OWASP LLM Top 10.
Comparison Table
| Framework | Type | Scope | Best for |
|---|---|---|---|
| NIST CSF | Governance | Organization-wide | Building or improving a security program. |
| ISO 27001 | Governance | ISMS | Certifiable compliance for global business. |
| CIS Controls | Controls | Technical safeguards | Prioritized, practical implementation. |
| NIST SP 800-53 | Controls | Systems | US federal & defense systems. |
| MITRE ATT&CK | Attack model | Adversary TTPs | Threat modeling & detection engineering. |
| Cyber Kill Chain | Attack model | Intrusion phases | High-level attack-stage mapping. |
| PTES | Testing method | Pentest lifecycle | Structuring network pentests. |
| OWASP WSTG | Testing method | Web apps | Systematic web vulnerability testing. |
| OWASP ASVS | Verification | Web apps | Requirements/verification checklists. |
| MITRE D3FEND | Defense model | Countermeasures | Mapping defenses to ATT&CK techniques. |
| PCI DSS | Compliance | Cardholder data | Any business processing card payments. |
| GDPR / HIPAA | Compliance | Personal/health data | Privacy and healthcare obligations. |
| NIST AI RMF | Governance | AI systems | Managing AI-specific risk. |
| OWASP LLM Top 10 | Attack model | LLM apps | Securing LLM applications. |
Risk & Governance Frameworks
These define how an organization manages security at the strategic level.
NIST Cybersecurity Framework
CSF 2.0A voluntary, risk-based framework organized into six functions.
NIST Risk Management Framework
RMFA lifecycle for authorizing systems to operate with acceptable risk.
ISO/IEC 27001
ISMSInternational standard for an Information Security Management System; certifiable by auditors.
ISO/IEC 27002
ControlsThe companion catalog of security controls that supports ISO 27001 implementation.
COBIT
ISACAA framework for governance and management of enterprise IT, aligning security with business goals.
FAIR
Risk QuantFactor Analysis of Information Risk — a model for quantifying risk in financial terms (loss exposure).
NIST SP 800-30
Risk AssessGuide for conducting risk assessments — threat sources, likelihood, impact, and mitigation.
COSO ERM
EnterpriseEnterprise Risk Management framework linking security risk to broader business risk and controls.
Attack & Threat Frameworks
Model how adversaries think and operate — essential for red teaming, detection engineering, and threat modeling.
MITRE ATT&CK
ATT&CKThe de-facto knowledge base of adversary tactics, techniques, and procedures (TTPs).
Cyber Kill Chain
LockheedA 7-phase model of an intrusion from recon to actions-on-objectives.
MITRE ATLAS
AI ThreatsThe ATT&CK-style matrix for threats targeting AI/ML systems.
OWASP Top 10
WebThe most critical web application security risks, refreshed every few years.
OWASP API Top 10
APITop risks for APIs: broken object-level auth, broken auth, excessive data exposure, etc.
OWASP LLM Top 10
LLMTop risks for LLM applications: prompt injection, insecure output handling, excessive agency…
STRIDE
Threat ModelA threat-modeling taxonomy: Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation.
DREAD
Risk RatingA scoring model for rating threats: Damage, Reproducibility, Exploitability, Affected users, Discoverability.
Penetration Testing Methodologies
Structured approaches for planning and executing security tests.
PTES
PentestPenetration Testing Execution Standard — a full lifecycle from pre-engagement to reporting.
OWASP WSTG
Web TestingWeb Security Testing Guide — a comprehensive catalog of web app tests.
OSSTMM
TestingOpen Source Security Testing Methodology Manual — a metrics-driven testing standard.
OWASP ASVS
VerificationApplication Security Verification Standard — leveled requirements for verifying app security.
OWASP MASVS
MobileMobile Application Security Verification Standard for Android/iOS apps.
NIST SP 800-115
Testing GuideTechnical guide to information security testing and assessment (US federal).
OWASP MSTG
Mobile TestingMobile Security Testing Guide — practical tests pairing with MASVS requirements.
Defensive & Controls Frameworks
Concrete safeguards to implement and how to map defenses to attacks.
CIS Controls
18 ControlsPrioritized, actionable safeguards (formerly SANS Top 20).
CIS Benchmarks
HardeningVendor-specific hardening guides for OS, cloud, and software configurations.
NIST SP 800-53
ControlsCatalog of security and privacy controls for federal systems (20 control families).
MITRE D3FEND
CountermeasuresA knowledge base mapping defensive techniques to ATT&CK techniques.
NIST SP 800-61
IR GuideComputer security incident handling guide — the standard IR lifecycle.
ISO 27035
IR StandardInternational standard for information security incident management.
Compliance & Privacy Standards
Legally or contractually binding requirements — non-negotiable for many businesses.
PCI DSS
CardsPayment Card Industry Data Security Standard for handling cardholder data.
GDPR
EU PrivacyEU regulation governing personal data protection, with heavy fines.
HIPAA
HealthcareUS law protecting protected health information (PHI).
SOC 2
AuditAn attestation report on a service org’s controls (Type I design / Type II operating).
CCPA / CPRA
US PrivacyCalifornia privacy laws giving consumers rights over personal data.
FISMA
US FederalLaw requiring US federal agencies to secure systems using NIST standards.
SOX
FinancialSarbanes-Oxley — financial reporting controls with IT security implications.
AI Security Frameworks
Emerging but rapidly maturing standards for AI/ML system security.
NIST AI RMF
AI RMFAI Risk Management Framework — a voluntary framework for managing AI risk.
OWASP LLM Top 10
LLMTop 10 risks for LLM apps, from prompt injection to excessive agency.
MITRE ATLAS
AI ThreatsAdversarial threat matrix for AI systems, aligned with ATT&CK.
EU AI Act
RegulationEurope’s risk-based regulation of AI systems, with tiered obligations.
OWASP ML Top 10
MLTop risks for machine learning systems (data, model, and deployment layers).
Scoring & Enumeration Standards
Shared vocabularies for describing and rating vulnerabilities.
CVE
IdentifiersCommon Vulnerabilities and Exposures — unique IDs for disclosed vulnerabilities.
CVSS
ScoringCommon Vulnerability Scoring System — 0–10 severity rating.
CWE
WeaknessesCommon Weakness Enumeration — catalogs software weakness types.
CAPEC
Attack PatternsCommon Attack Pattern Enumeration and Classification — how attacks are performed.
EPSS
PredictionExploit Prediction Scoring System — likelihood a CVE will be exploited in the wild.
CPE
PlatformsCommon Platform Enumeration — a naming scheme for software/hardware products.