NIST CSF Category ID.RA
Risk assessment is a cornerstone of cybersecurity, and normative documents are essential in providing structured methodologies and legal expectations for evaluating threats, vulnerabilities, and potential impacts. Standards such as ISO/IEC 27005 for information security risk management and NIST SP 800-30 for risk assessment guidance outline best practices for identifying, analyzing, and prioritizing risks to information systems. Regulatory frameworks like the EU NIS2 Directive or the Gramm-Leach-Bliley Act (GLBA) in the U.S. require organizations to perform documented risk assessments as part of compliance obligations. By adhering to these standards and regulations, organizations can make informed decisions on risk mitigation, ensure accountability, and build trust with stakeholders while aligning with national and international cybersecurity expectations.
The Cloud Security Alliance’s (CSA) Cloud Adversarial Vectors, Exploits, and Threats (CAVEaT™) is an emerging, cloud-centric threat matrix designed to address the unique and rapidly evolving security risks in cloud… Read More »CSA Cloud Adversarial Vectors, Exploits, and Threats (CAVEaT™): An Emerging Threat Matrix for Industry Collaboration
The FIRST CVSS Calculator is an interactive tool provided by the Forum of Incident Response and Security Teams (FIRST) that enables users to assess the severity of software vulnerabilities using… Read More »FIRST Common Vulnerability Scoring System (CVSS) Calculator Version 4.0
ISO/IEC 27005 is an international standard that provides comprehensive guidelines for information security risk management, forming a key part of the ISO/IEC 27000 family of standards. It outlines a structured… Read More »ISO/IEC 27005:2022 Information security, cybersecurity and privacy protection — Guidance on managing information security risks ★★★★★
The CIS Controls Cloud Companion Guide v8 provides detailed guidance on applying the security best practices from CIS Controls version 8 to cloud environments from the consumer or customer perspective.… Read More »CIS Controls Cloud Companion Guide v8
The latest version of ISO/IEC 27002 was published on February 15, 2022. This 2022 revision replaced the previous 2013 edition and introduced significant changes including a reduction in the number… Read More »ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls ★★★★★
The Cloud Security Alliance Cloud Controls Matrix (CSA CCM) is a comprehensive cybersecurity control framework specifically designed for cloud computing environments. It consists of 197 control objectives organized into 17… Read More »CSA Cloud Controls Matrix (CCM) v4 ★★★★★
The MITRE Common Attack Pattern Enumeration and Classification (CAPEC) is a publicly available, comprehensive catalog that documents and categorizes common attack patterns used by adversaries to exploit software and systems.… Read More »MITRE CAPEC – Common Attack Pattern Enumeration and Classification Version 3.9
MITRE’s Common Weakness Enumeration (CWE) is a community-developed, comprehensive list and classification taxonomy of common software and hardware weaknesses that can lead to security vulnerabilities. It identifies and describes these… Read More »MITRE CVE (Common Vulnerabilities and Exposures)