Knowledge centre

Standards and framework document library.

Name: Threatsys, Australia
Address: Level 25, 108 St Georges Terrace, Perth WA 6000, Australia, Perth, Australia
Telephone: +91 96682 00222

Every standard our assessors work against, 122 of them, each with the practitioner view rather than a restatement of the text. What it is, who it binds, what an assessor actually looks for, and how to get ready.

122 of 122

Security frameworks33

The control catalogues and models an assessment is run against. Pick the one your customers or your regulator names, not the one with the most controls.

NIST Cybersecurity Framework (CSF 2.0)NIST · GLOBALA voluntary, outcome-based framework for managing and reducing cybersecurity risk.Read the guide
NIST SP 800-53NIST · GLOBALA comprehensive catalog of security and privacy controls for information systems.Read the guide
COBITISACA · GLOBALA governance and management framework for enterprise information and technology.Read the guide
CIS ControlsCENTER FOR INTERNET SECURITY · GLOBALA prioritised set of 18 safeguards that stop the most common attacks.Read the guide
MITRE ATT&CKMITRE · GLOBALA knowledge base of real-world adversary tactics and techniques.Read the guide
SANS / CWE Top 25MITRE / SANS · GLOBALThe most dangerous and common software weaknesses developers must avoid.Read the guide
OWASP Top 10OWASP · GLOBALThe standard awareness document for the most critical web application risks.Read the guide
SABSA (Security Architecture)THE SABSA INSTITUTE · GLOBALA business-driven framework and methodology for enterprise security architecture.Read the guide
CSA CCM & STARCLOUD SECURITY ALLIANCE · GLOBALThe Cloud Controls Matrix and STAR programme for cloud security assurance.Read the guide
TOGAFTHE OPEN GROUP · GLOBALThe leading enterprise architecture framework and method (ADM).Read the guide
NIST SP 800-171NIST · GLOBAL / USProtecting Controlled Unclassified Information (CUI) in non-federal systems.Read the guide
IEC 62443 (OT/ICS Security)IEC / ISA · GLOBALThe standard for cybersecurity of industrial automation and control systems.Read the guide
Zero Trust (NIST SP 800-207)NIST · GLOBALA security model of "never trust, always verify" for modern architectures.Read the guide
MITRE D3FENDMITRE · GLOBALA knowledge base of defensive countermeasures mapped to ATT&CK.Read the guide
OWASP ASVSOWASP · GLOBALA detailed, testable standard for verifying application security.Read the guide
COSO Internal Control FrameworkCOSO · GLOBALThe leading framework for internal control and enterprise risk management.Read the guide
MITRE ATLAS (AI/ML Threats)MITRE · GLOBALA knowledge base of adversarial threats to AI and machine-learning systems.Read the guide
OWASP API Security Top 10OWASP · GLOBALThe most critical security risks to APIs.Read the guide
ISO/IEC 27005 (Information Security Risk Management)ISO / IEC · GLOBALGuidance for managing information security risk.Read the guide
ISO/IEC 27035 (Incident Management)ISO / IEC · GLOBALThe standard for information security incident management.Read the guide
ISO/IEC 27031 (ICT Continuity)ISO / IEC · GLOBALICT readiness for business continuity.Read the guide
ISO/IEC 29147 & 30111 (Vulnerability Disclosure)ISO / IEC · GLOBALStandards for vulnerability disclosure and handling.Read the guide
NIST Secure Software Development Framework (SSDF)NIST · GLOBALSecure software development practices (SP 800-218).Read the guide
NIST SP 800-63 (Digital Identity)NIST · GLOBALDigital identity guidelines, identity proofing, authentication and federation.Read the guide
NIST AI Risk Management FrameworkNIST · GLOBALVoluntary framework to manage risks of AI systems.Read the guide
CSA AI Controls Matrix (AICM)CLOUD SECURITY ALLIANCE · GLOBALCSA control matrix for securing and governing AI systems.Read the guide
Cyber Risk Institute (CRI) ProfileCYBER RISK INSTITUTE · GLOBAL (FINANCE)Harmonised cybersecurity profile for the financial sector.Read the guide
Secure Controls Framework (SCF)SECURE CONTROLS FRAMEWORK COUNCIL · GLOBALMetaframework mapping controls across 100+ authorities.Read the guide
NIST SP 800-161 (C-SCRM)NIST · GLOBALCyber supply-chain risk management practices for systems.Read the guide
NIST SP 800-82 (OT Security)NIST · GLOBALGuide to securing operational technology and control systems.Read the guide
NIST Ransomware Risk Management ProfileNIST · GLOBALCSF profile to prevent, detect and recover from ransomware.Read the guide
Cybersecurity Capability Maturity Model (C2M2)US DOE · GLOBALMaturity model to evaluate and improve cyber capabilities.Read the guide
CryptoCurrency Security Standard (CCSS)C4 (CRYPTOCURRENCY CERTIFICATION CONSORTIUM) · GLOBALSecurity standard for systems that use cryptocurrencies.Read the guide

Certifications and attestations24

Standards you can be certified or attested against, where the deliverable is a certificate or a report somebody else will read.

Data privacy laws10

Statutory obligations that attach to personal data. These bind you whether or not anyone asks for a certificate.

India regulatory33

Directions and frameworks issued by Indian regulators. Most organisations we assess are inside more than one of these at once.

Regional and national frameworks22

Country and region specific requirements, relevant where you operate, hold data or serve customers there.

Not sure which one applies?

Most organisations are inside more than one of these at once, and the overlap is larger than it looks: the same access review, the same log retention and the same incident record can satisfy three frameworks if you build the control once. A thirty minute call with an assessor will usually shorten your list rather than lengthen it.

Not sure where to start?

Book a 30-minute call with a senior engineer. We will walk through your current posture, the frameworks that bind you, and what a realistic programme looks like.

Book a 30-min consultation +91 96682 00222