Roadmaps Security roadmaps Frameworks & standards
Security frameworks and standards
The frameworks, standards and laws that come up again and again in security work, each with one line on what it is for and a link to the official source.
Official sources only
The essential reference list
-
NIST Cybersecurity Framework (CSF) 2.0 Governance and controls
A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
-
ISO/IEC 27001 Governance and controls
The international standard for an information security management system (ISMS), and the one organisations get certified against.
-
ISO/IEC 27002 Governance and controls
Guidance on how to apply each of the 93 security controls listed in ISO/IEC 27001.
-
CIS Critical Security Controls Governance and controls
A prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
-
MITRE ATT&CK Threats and defence
A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
-
MITRE D3FEND Threats and defence
A knowledge graph of defensive techniques, mapped to the ATT&CK techniques they counter.
-
OWASP Top 10 Applications and software
The ten most critical web application security risks, updated every few years from real data.
-
OWASP API Security Top 10 Applications and software
The ten most common and serious risks in APIs, such as broken object-level authorisation.
-
OWASP GenAI Security Project AI
Home of the OWASP Top 10 for LLM Applications and guidance on securing generative and agentic AI.
-
MITRE ATLAS AI
ATT&CK-style knowledge base of attacks on AI and machine learning systems, with real case studies.
-
NIST AI Risk Management Framework (AI RMF) AI
A voluntary framework to map, measure, manage and govern the risks of AI systems.
-
ISO/IEC 42001 AI
The international standard for an AI management system, the AI counterpart to ISO/IEC 27001.
-
CVE (Common Vulnerabilities and Exposures) Vulnerabilities
Gives every publicly known vulnerability a unique ID, such as CVE-2021-44228, so everyone talks about the same flaw.
-
CWE (Common Weakness Enumeration) Vulnerabilities
A catalogue of the types of software and hardware weaknesses that cause vulnerabilities.
-
CVSS (Common Vulnerability Scoring System) Vulnerabilities
A standard way to score how severe a vulnerability is, from 0 to 10.
-
SOC 2 Audit and compliance
An audit report on how a service provider protects customer data, very common for SaaS companies.
-
PCI DSS Audit and compliance
The security standard every organisation that stores, processes or sends payment card data must meet.
-
GDPR (General Data Protection Regulation) Laws and regulations
The EU law on personal data: lawful use, people's rights, breach notification and security of processing.
-
NIS2 Directive Laws and regulations
The EU law that sets security and incident reporting duties for essential and important organisations.
-
EU AI Act Laws and regulations
The EU law that regulates AI by risk level, including security and robustness duties for high-risk systems.
Also used on the roadmaps
-
NIST SP 800-53 Rev. 5 Governance and controls
The large catalogue of security and privacy controls that many other frameworks map to.
-
CIS Benchmarks Governance and controls
Free, consensus hardening guides for operating systems, cloud accounts, network devices and software.
-
NIST SP 800-61 Rev. 3 Threats and defence
Incident response recommendations, aligned with CSF 2.0.
-
NIST SP 800-86 Threats and defence
How to build forensic techniques into incident response: collection, examination, analysis and reporting.
-
ISO/IEC 27037 Threats and defence
Guidelines for identifying, collecting, acquiring and preserving digital evidence.
-
CISA Known Exploited Vulnerabilities (KEV) catalog Vulnerabilities
The list of vulnerabilities known to be exploited in the wild; a practical guide to what to patch first.
-
NIST SP 800-207 Zero Trust Architecture Identity
Defines zero trust: never trust a request because of where it comes from, check identity and context every time.
-
NIST SP 800-63-4 Digital Identity Guidelines Identity
Requirements for identity proofing, authentication (including passwords and MFA) and federation.
-
OAuth 2.0 (RFC 6749) Identity
The standard for delegated authorisation: letting an app act for a user without their password.
-
OpenID Connect Identity
The identity layer on top of OAuth 2.0 that most single sign-on uses.
-
FIDO2 and passkeys Identity
Standards for phishing-resistant, passwordless sign-in with security keys and passkeys.
-
CSA Cloud Controls Matrix (CCM) Governance and controls
A cloud-specific control framework, mapped to ISO/IEC 27001, NIST and others.
-
AWS Well-Architected Framework, Security Pillar Governance and controls
AWS's own design principles and best practices for securing workloads in the cloud.
-
NIST SP 800-218 Secure Software Development Framework (SSDF) Applications and software
A set of secure development practices that buyers, including the US government, ask software makers to follow.
-
OWASP ASVS (Application Security Verification Standard) Applications and software
A detailed list of security requirements to design, build and test web applications against.
-
OWASP SAMM Applications and software
A maturity model to measure and improve an organisation's software security programme.
-
SLSA (Supply-chain Levels for Software Artifacts) Applications and software
Levels of build integrity and provenance that protect software from tampering between source and release.
Nothing matches. Try a shorter word.
Standards from ISO and some industry bodies cost money to read in full; their official pages describe them for free. Laws from the EU are free to read in every EU language on EUR-Lex.
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact