A wide range of documents provides universally applicable guidance and requirements for organizations across industries. These include laws and regulations like the General Data Protection Regulation and NIS2 Directive, standards such as ISO/IEC 27001, frameworks like the NIST Cybersecurity Framework, practical guidelines from authorities such as European Union Agency for Cybersecurity, contractual obligations, mapping documents reconciling multiple issuers, and tools—online or downloadable—that help operationalize these requirements. Their broad applicability across sectors ensures organizations can implement consistent, auditable cybersecurity practices that meet both legal obligations and industry-agnostic best practices.
The FIRST CVSS Calculator is an interactive tool provided by the Forum of Incident Response and Security Teams (FIRST) that enables users to assess the severity of software vulnerabilities using… Read More »FIRST Common Vulnerability Scoring System (CVSS) Calculator Version 4.0
NIST SP 800-221 serves as the critical functional bridge between enterprise-level strategy and technical delivery, focusing on the Enterprise Impact of Information and Communications Technology (ICT) Risk. It moves beyond… Read More »NIST SP 800-221 Enterprise Impact of Information and Communications Technology Risk: Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio
The ANSSI document “Recommandations pour l’administration sécurisée des SI reposant sur Active Directory” provides comprehensive guidance to secure information systems (SI) that rely on Microsoft’s Active Directory (AD). It emphasizes… Read More »ANSSI Recommendations for Secure Administration of AD-based IS (FRENCH)
The CISA #StopRansomware Guide is a comprehensive, one-stop resource designed to help organizations prevent, detect, respond to, and recover from ransomware and data extortion incidents. Developed collaboratively by CISA, the… Read More »CISA Stop Ransomware Guide ★★★★★
The AICPA SOC 2 Trust Services Principles and Criteria, outlined in TSP Section 100 (2017, regularly updated), provide a comprehensive framework for evaluating and reporting on a service organization’s controls… Read More »AICPA SOC2 Trust Services Principles and Criteria – TSP Section 100
NIST Special Publication 800-82 Revision 3, titled “Guide to Operational Technology (OT) Security,” provides comprehensive guidance on securing operational technology systems, which include a wide range of programmable devices and… Read More »NIST SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security
The Secure AI Framework (SAIF), developed by Google, is a comprehensive set of guidelines and best practices aimed at ensuring the security, privacy, and integrity of artificial intelligence (AI) systems… Read More »Google Secure AI Framework (SAIF) ★★★★★
BSI Standard 200-4 focuses on establishing and maintaining an effective Business Continuity Management System (BCMS), providing a structured methodology for organizations to ensure critical business processes remain functional during and… Read More »BSI Standard 200-4: Business Continuity Management (BCM)
The Cross-Sector Cybersecurity Performance Goals (CPGs) document provides a concise, prioritized set of cybersecurity objectives designed to help organizations across various critical infrastructure sectors enhance their cyber resilience. It outlines… Read More »CISA CPG Cross-Sector Cybersecurity Performance Goals
The EU NIS 2 Directive, formally known as Directive (EU) 2022/2555, establishes a unified legal framework to enhance cybersecurity across the European Union by setting stricter and more comprehensive requirements… Read More »EU Directive 2022/2555 Network and Information Security Directive (NIS2)