✳ Reference / Frameworks
Same site.
Different maps.
Use this table to see what each framework is for. A row is not a crosswalk, and a relationship is not proof that one control satisfies another.
| Framework | Purpose | Prescriptive vs outcome | Certifiable? | Primary user | Typical misuse |
|---|---|---|---|---|---|
| CSF 2.0 (CSWP 29) | Communicate cybersecurity risk outcomes | Outcome taxonomy; does not prescribe how | No CSF certificate is part of the framework | Leadership and practitioners aligning language | Treating a profile spreadsheet as an audit pass |
| CIS Controls v8.1 | Prioritized safeguards and Implementation Groups | More prescriptive safeguards | Not a formal certification scheme like ISO. A vendor “aligned” claim is not a certificate | Builders and defenders implementing hygiene | Claiming CIS is done, so CSF or ISO is done |
| ISO/IEC 27001:2022 | Requirements for an information security management system | Management-system requirements, plus Annex A references | Yes. Accredited certification of a scoped ISMS | GRC and management-system owners | Using the logo as proof that a product is secure |
| SP 800-53 Rev. 5 (Rel. 5.2.0) | Select and tailor a control catalog | Catalog of controls, with baselines in SP 800-53B | Used inside authorization processes. Not a consumer sticker | Assessors, federal and Fed-adjacent programs, and control engineers | Implementing every control without tailoring |
| MITRE ATT&CK v19.2 | Describe adversary behaviors | Descriptive knowledge base | No | Detection engineering, threat intelligence, and red and blue teams | Treating coverage percentage as a compliance score |
| OWASP Top 10:2025 | Awareness of common application risks | Awareness list. Not ASVS, and not the LLM Top 10 | No | Developers and application-security educators | Treating the list as a complete test standard |
CIS Controls Version 8.1 Implementation Groups (IG1, then IG2, then IG3) are a hygiene prioritization discipline. Read the CIS Implementation Groups explainer. It complements the CIS Controls card.
MITRE ATT&CK v19.2 is an adversary behavior knowledge base. A matrix cell is a behavior label, not coverage proof. Read the MITRE ATT&CK explainer. It complements the MITRE ATT&CK card.
OWASP Top 10:2025 is a limited awareness list of web application risk themes (the 8th installment). Ten category labels are not a finished test. Read theOWASP Top 10 explainer. It complements theOWASP Top 10 card.
OWASP ASVS 5.0.0 is a requirements and verification project for web applications and services (dated May 2025, released 2025-05-30, tag v5.0.0_release). Levels L1, L2, and L3 are verification depth, not a certificate. Read theOWASP ASVS explainer. It complements theOWASP Top 10 explainerand theOWASP Top 10 card.
OWASP GenAI LLM Top 10 2026 is a separate limited awareness list for applications that use large language models (GitHub published 2026-08-04; the genai.owasp.org resource page is stamped 2026-08-03). Ten LLM labels are a separate list from web Top 10:2025. Read theOWASP LLM Top 10 explainer. Compare does not add a seventh map object.
NIST AI RMF 1.0 (NIST AI 100-1, published 2023-01-26) is a separate voluntary framework (Govern, Map, Measure, Manage). Read theNIST AI RMF 1.0 explainer. The field guide stays atNIST AI RMF 1.0. Compare does not add a seventh map object.
NIST SSDF Version 1.1 (NIST SP 800-218, final February 2022) is a separate software security practice vocabulary (Prepare the Organization, Protect the Software, Produce Well-Secured Software, Respond to Vulnerabilities). It is not an SBOM. Read theNIST SSDF Version 1.1 explainer. The field guide stays atNIST SSDF Version 1.1. Compare does not add a seventh map object.
Three second-wave field guides (SP 800-207, SSDF Version 1.1, and AI RMF 1.0) sit beside these six maps and are not rows in this table.Open the field guides.