Helpful first: Assets and the CIA triad: what we protect and how it fails · Threat, vulnerability, and risk: the core equation · Identity, authentication, authorization, and recovery · Least privilege, defense in depth, and Zero Trust boundaries · Logs, alerts, and evidence: why an alert title is a hypothesis, not proof
Key points
- State a concrete risk reduction outcome before selecting a technical control or framework citation
- Differentiate the purpose and abstraction level of NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-53, CIS Controls v8.1, OWASP ASVS, and MITRE ATT&CK
- Classify safeguards by function (Preventive, Detective, Corrective, Deterrent, Compensating) and implementation type (Administrative, Technical, Physical)
Why "we need to adopt a framework" is backwards without an outcome
After a near-miss involving an unrevoked contractor token at Meridian Space & Robotics (chronos.), three managers walk into Principal Security Architect Vera Vance’s office with three different demands: "We need ISO 27001," "We need MITRE ATT&CK coverage," and "We need NIST 800-53."
Vera pauses the debate. Frameworks are taxonomies and catalogs, not magic shields. Before picking a framework citation, you must write the operational outcome you need to achieve - for example: "Ensure contractor access to orbital telemetry expires automatically within 15 minutes of contract end, and alert the SOC if an expired identity attempts token refresh." Once the outcome is clear, each framework plays a distinct, complementary job.
Operational outcome
Ensure contractor access to orbital telemetry expires automatically within 15 minutes of contract end, and alert the SOC if an expired identity attempts token refresh.
NIST CSF 2.0
Primary Abstraction Level: 6 High-Level Outcome Functions (Govern, Identify, Protect, Detect, Respond, Recover). Best Used For: Organizing program strategy, executive risk reporting, and cross-team alignment.
ISO/IEC 27001:2022
Primary Abstraction Level: Information Security Management System (ISMS Clauses 4-10 + Annex A controls). Best Used For: Formal third-party certification proving a risk-based management cadence and Statement of Applicability (SoA).
NIST SP 800-53 Rev. 5 & CIS Controls v8.1
Primary Abstraction Level: Detailed control catalogs. SP 800-53 has 20 control families, and CIS has 18 Controls, 153 Safeguards, and 3 Implementation Groups (IG1 to IG3). Best Used For: Selecting concrete administrative, technical, and physical safeguards.
MITRE ATT&CK
Primary Abstraction Level: Adversary Tactics, Techniques, and Sub-techniques (TTPs). Best Used For: Mapping real-world attacker behavior to test and tune Detect and Respond coverage.
OWASP Top 10 & ASVS
Primary Abstraction Level: Application Security Risks (Top 10) and Verification Requirements (ASVS Levels 1-3). Best Used For: Setting testable secure coding and architecture acceptance criteria for software teams.
| Framework / Standard | Primary Abstraction Level | Best Used For | What It Is NOT |
|---|---|---|---|
| NIST CSF 2.0 | 6 High-Level Outcome Functions (Govern, Identify, Protect, Detect, Respond, Recover) | Organizing program strategy, executive risk reporting, and cross-team alignment | Not a certifiable audit standard or a step-by-step configuration script |
| ISO/IEC 27001:2022 | Information Security Management System (ISMS Clauses 4-10 + Annex A controls) | Formal third-party certification proving a risk-based management cadence and Statement of Applicability (SoA) | Not a low-level technical hardening benchmark for specific cloud APIs |
| NIST SP 800-53 Rev. 5 & CIS Controls v8.1 | Detailed control catalogs: 20 control families in SP 800-53, and 18 Controls, 153 Safeguards, and 3 Implementation Groups (IG1 to IG3) in CIS | Selecting concrete administrative, technical, and physical safeguards | Not an adversary threat-intelligence taxonomy |
| MITRE ATT&CK | Adversary Tactics, Techniques, and Sub-techniques (TTPs) | Mapping real-world attacker behavior to test and tune your Detect and Respond coverage | Not a governance or compliance management framework |
| OWASP Top 10 & ASVS | Application Security Risks (Top 10) and Verification Requirements (ASVS Levels 1-3) | Setting testable secure coding and architecture acceptance criteria for software teams | Not an enterprise-wide physical or HR security standard |
Control taxonomy: Preventive, Detective, Corrective, and Compensating
In both architecture reviews and the CISSP exam, controls are classified along two axes: how they are implemented (Administrative/Managerial policies, Technical/Logical code and ACLs, or Physical locks and guards) and when they act relative to an event.
A Preventive control stops the unauthorized action before it succeeds (such as an IAM policy denying public bucket creation). A Detective control discovers and logs the event as or after it occurs (such as a SIEM alert or file-integrity monitor). A Corrective control restores normal state after a fault (such as an automated Terraform drift remediation or backup restore). And when a primary control cannot be deployed on a legacy system, a Compensating control provides an alternative safeguard that achieves equivalent risk reduction (such as isolating an unpatchable ground-station controller on an mTLS-gated VLAN with strict allowlisting).
Walking one Meridian outcome across four frameworks
Watch how Vera maps Meridian’s contractor-access outcome across the catalog without duplicating work: the goal sits under NIST CSF 2.0 Protect (PR.. The formal policy and quarterly access review live in Meridian’s ISO/IEC 27001 ISMS and map to NIST SP 800-53 AC-. And Threat Hunter Nyx validates the detective alert by simulating MITRE ATT&CK technique T1078 (Valid Accounts) during a purple-team exercise.
Outcome function
NIST CSF 2.0 Protect (PR.AA - Identity Management, Authentication, and Access Control).
Management system
The formal policy and quarterly access review live in the ISO/IEC 27001 ISMS.
Account safeguard
NIST SP 800-53 AC-2 (Account Management).
Behavior test
MITRE ATT&CK technique T1078 (Valid Accounts) during a purple-team exercise.
Why a green spreadsheet never equals working security
Marking "Compliant" in a GRC spreadsheet because a policy PDF exists on SharePoint changes zero packets on the network. An outcome is only met when the control is implemented in production and continuously produces verifiable operational evidence.
GRC spreadsheet
Compliant, because a policy PDF exists on SharePoint.
Network
That policy PDF changes zero packets on the network.
Production
The control is implemented in production.
Evidence
The control produces verifiable operational evidence.
CHECK YOUR JUDGMENT