🔗 Security Framework Alignment

Industry-standard guidance for web and API security, including the OWASP Top 10, ASVS, and testing guides.

CVSS provides standardized vulnerability severity scoring (0-10). CVE (Common Vulnerabilities and Exposures) catalogs known vulnerabilities. KEV (Known Exploited Vulnerabilities) tracks actively exploited flaws.

The 25 most dangerous CWE (Common Weakness Enumeration) software weaknesses ranked by prevalence and impact. Maintained by MITRE, mapped to real-world CVEs in NVD — essential for secure coding and vulnerability prioritization.

Knowledge base of adversary tactics, techniques, and procedures (TTPs) for threat modeling and detection engineering.

A prioritized set of 18 cybersecurity best practices (v8) designed to mitigate the most common cyber attacks. Organized into Implementation Groups (IG1, IG2, IG3) for phased adoption.

U.S. federal agency providing cybersecurity guidance, vulnerability advisories, Known Exploited Vulnerabilities (KEV) catalog, and Shields Up initiatives for critical infrastructure.

U.S. interagency body (OCC, FDIC, Fed, NCUA, CFPB) that sets uniform IT examination standards for banks and credit unions. The FFIEC IT Handbook covers information security, business continuity, outsourcing, and cybersecurity assessment tools (CAT).

EU regulation governing the collection, processing, and storage of personal data for EU residents. Applies extraterritorially to any organization handling EU personal data. Establishes data subject rights, breach notification requirements, and significant penalties for non-compliance.

U.S. federal law requiring financial institutions to explain how they share and protect customers' private information. The Safeguards Rule mandates a comprehensive information security program with administrative, technical, and physical safeguards.

International standards for establishing, implementing, and maintaining an information security management system (ISMS).

A voluntary framework of standards, guidelines, and best practices for managing cybersecurity risk across five functions.

Comprehensive security controls and guidelines — SP 800-53, 800-171, 800-63 for federal and enterprise systems.

A set of 12 requirements for organizations that handle credit card data. Mandates network security, data encryption, access control, vulnerability management, and regular testing to protect cardholder data environments (CDE).

U.S. federal law mandating strict financial reporting controls and IT governance for publicly traded companies. Section 404 requires management assessment of internal controls over financial reporting (ICFR), including IT general controls (ITGCs).