Risk, privacy & standards · 8 min
CIS Implementation Groups: where to start
CIS Controls Version 8.1 Implementation Groups are recommended guidance to prioritize Safeguards. IG1 is essential cyber hygiene, the foundational first set.
✳ Reference / Standards & explainers
Authoritative standards, protocols, and regulatory boundaries.
How primary standards, cryptographic protocols, privacy regimes, and audit reports actually operate in production architecture, complete with edition pins, common folklore corrections, and decision checks.
27 results
Guidance explainer
Risk, privacy & standards · 8 min
CISA CPGs: prioritized security practices
CISA Cross-Sector Cybersecurity Performance Goals version 2.0 are voluntary prioritized practices for critical infrastructure. They cover IT and OT themes.
Risk, privacy & standards · 8 min
CMMC: defense contractor assessments
CMMC is the Cybersecurity Maturity Model Certification program. CMMC covers FCI and CUI safeguarding for the Defense Industrial Base. Under the current Phase I pause, Level 1 and Level 2 use self-assessments. CMMC is not FedRAMP.
Cloud security · 8 min
FedRAMP: federal cloud authorization
FedRAMP is a standardized, reusable approach to security assessments and authorizations for cloud products and services used by federal agencies. The customer still owns the configuration work that remains.
Risk, privacy & standards · 8 min
FERPA: student education records
FERPA is the U.S. federal law governing student education records at institutions funded by the Department of Education.
Risk, privacy & standards · 8 min
FISMA: federal information security
FISMA is the statutory backdrop for federal agency information security management. That backdrop also covers systems operated on behalf of an agency.
Risk, privacy & standards · 8 min
FTC Safeguards Rule: customer information
The Safeguards Rule is the Standards for Safeguarding Customer Information. The Rule requires a written customer-information program for financial institutions under FTC jurisdiction.
Risk, privacy & standards · 8 min
GDPR: personal data and privacy
The EU General Data Protection Regulation (GDPR) governs the processing of personal data of natural persons, distinguishing controller and processor roles and requiring risk-appropriate security of processing under Article 32.
Risk, privacy & standards · 8 min
HIPAA Security Rule: health information safeguards
The U.S. federal HIPAA Security Rule sets administrative, physical, and technical safeguard standards for electronic protected health information at covered entities and business associates.
Risk, privacy & standards · 8 min
ISO/IEC 27001: managing information security
ISO/IEC 27001:2022 sets requirements for an information security management system. It is read with Amd 1:2024.
Identity & access · 8 min
Kerberos: how authentication tickets work
Kerberos Version 5 is a trusted third-party ticket protocol for network authentication.
Detection & response · 8 min
MITRE ATT&CK: understanding adversary behavior
MITRE ATT&CK v19.2 is an adversary behavior knowledge base. Teams use the knowledge base to tag behaviors and to hunt for evidence.
AI & agents · 8 min
NIST AI RMF 1.0: organizing AI risk work
NIST AI 100-1, Artificial Intelligence Risk Management Framework 1.0, published 2023-01-26, is a voluntary framework that organizes AI risk work. Govern, Map, Measure, and Manage are the four jobs that organize that work.
Detection & response · 8 min
NIST SP 800-137: continuous monitoring
NIST SP 800-137 is guidance for an Information Security Continuous Monitoring strategy and program for federal information systems and organizations.
Risk, privacy & standards · 8 min
NIST SP 800-171: protecting controlled information
NIST SP 800-171 gives recommended security requirements for the confidentiality of Controlled Unclassified Information in nonfederal systems. A contract can still cite an earlier revision than the NIST Final.
Identity & access · 8 min
NIST SP 800-207: zero trust architecture
NIST SP 800-207, Zero Trust Architecture, final August 2020, is an architecture paradigm for resource protection. Network location is not the prime trust signal.
Risk, privacy & standards · 8 min
NIST SP 800-30: assessing risk
NIST SP 800-30 Rev. 1 is guidance to conduct risk assessments of federal information systems and organizations.
Risk, privacy & standards · 8 min
NIST SP 800-37: the Risk Management Framework
NIST SP 800-37 Rev. 2 is the Risk Management Framework process for security and privacy risk.
Risk, privacy & standards · 8 min
NIST SP 800-53: choosing security and privacy controls
NIST SP 800-53 Revision 5, Release 5.2.0, is a catalog of security and privacy controls to select and tailor from.
Identity & access · 8 min
NIST SP 800-63-4: digital identity assurance
NIST SP 800-63-4 is the Digital Identity Guidelines. It is one suite for identity proofing and enrollment, authentication and authenticator management, and federation and assertions.
Risk, privacy & standards · 8 min
NIST SP 800-82: operational technology security
NIST SP 800-82 Rev. 3 is the Guide to Operational Technology Security. It gives guidance to secure OT and address performance, reliability, and safety.
Applications & software · 8 min
NIST SSDF 1.1: secure software development
NIST SP 800-218, Secure Software Development Framework Version 1.1, final February 2022, is a shared vocabulary for software security practices.
Applications & software · 8 min
OWASP ASVS 5.0.0: verifying application security
OWASP ASVS 5.0.0 is a requirements and verification project for web applications and services.
AI & agents · 8 min
OWASP LLM Top 10 (2026): AI application risks
OWASP GenAI LLM Top 10 2026 is a limited awareness list for applications that use large language models.
Applications & software · 8 min
OWASP Top 10 (2025): web application risks
OWASP Top 10:2025, the 8th installment, is a limited awareness list of web application risk themes.
Risk, privacy & standards · 8 min
PCI DSS: protecting payment data
PCI DSS is the Payment Card Industry Data Security Standard for protecting payment account data, with compliance programs run by payment brands and acquirers and supplemental e-skimming guidance published by the Council.
Risk, privacy & standards · 8 min
SOC 2: understanding an assurance report
SOC 2 is an AICPA attestation report on controls at a service organization for a described system. Scope, Trust Services Criteria categories, and Type I or Type II matter.
No matches. Try a broader search or clear the filters.
These architectural field guides are educational. For binding legal or regulatory determinations, consult the cited primary sources and qualified counsel for your organization.