Standards are formally developed documents that define agreed-upon requirements, controls, or best practices to ensure a consistent and measurable level of security across organizations. Unlike laws and regulations, standards are generally voluntary unless incorporated into contracts or referenced by legislation, but they often serve as benchmarks for certification, audit, and due diligence. For example, ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), while ISO/IEC 27002 provides detailed guidance on selecting and implementing security controls. Standards are typically consensus-based and internationally recognized, offering structured, auditable criteria that help organizations demonstrate maturity, comparability, and trustworthiness in their cybersecurity practices.
CSA A Practitioner’s Guide to Post-Quantum Cryptography is a practical resource designed to help security professionals safeguard sensitive data both in transit and at rest against the emerging threat posed… Read More »CSA A Practitioner’s Guide to Post-Quantum Cryptography
The OWASP AI Testing Guide provides a comprehensive framework for evaluating the security and reliability of AI systems. It outlines methodologies to identify risks such as model poisoning, adversarial attacks,… Read More »OWASP AI Testing Guide ★★★★★
This document is a comprehensive guide developed by the Center for Internet Security (CIS) in collaboration with SAFECode and a community of experts. It provides a practical, evaluable framework to… Read More »CIS Secure by Design: A Guide to Assessing Software Security Practices ★★★★★
NIST SP 800-88 Revision 2, “Guidelines for Media Sanitization,” provides comprehensive instructions on securely removing data from electronic media to render access to the information infeasible, regardless of the effort… Read More »NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization
The SEC’s Post-Quantum Financial Infrastructure Framework (PQFIF) is a comprehensive strategic plan designed to secure the U.S. financial system against the emerging threats posed by quantum computing advancements. Its primary… Read More »SEC Post-Quantum Financial Infrastructure Framework (PQFIF) ★★★★★
NIST Internal Report (IR) 8349, titled “Methodology for Characterizing Network Behavior of Internet of Things Devices,” outlines a comprehensive approach to capturing, documenting, and analyzing the network communication behaviors of… Read More »NIST IR 8349 Methodology for Characterizing Network Behavior of Internet of Things Devices
The CIS Controls Internet of Things (IoT) Companion Guide provides detailed guidance on how to apply the cybersecurity best practices of the CIS Controls, particularly Version 8.1, to IoT environments.… Read More »CIS Controls Internet of Things Companion Guide ★★★★★
The CSA MLOps Overview content provides industry guidance on the principles and practices for securely and efficiently operationalizing machine learning models in production. It emphasizes the integration of security practices… Read More »CSA MLOps Overview
The CSA’s paper “Agentic AI Identity and Access Management: A New Approach” addresses the inadequacy of traditional IAM systems when applied to autonomous, dynamic agentic AI systems operating in multi-agent… Read More »CSA Agentic AI Identity and Access Management
The CISA guidance titled “Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators” provides operational technology (OT) owners and operators across critical infrastructure sectors with practical, step-by-step recommendations… Read More »CISA Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators