security-frameworks

Security Frameworks Planning

Comprehensive guidance for security framework alignment and control mapping before development begins.

When to Use This Skill

• Preparing for ISO 27001 certification
• Planning SOC 2 Type I or Type II audits
• Implementing NIST Cybersecurity Framework 2.0
• Mapping CIS Controls to your environment
• Creating cross-framework control mappings

Framework Comparison

When to Use Which Framework

Framework	Best For	Certification?	Geography
ISO 27001	Enterprise ISMS, international recognition	Yes (3rd party)	Global
SOC 2	SaaS/Cloud providers, customer trust	Yes (CPA firm)	Primarily US
NIST CSF	Risk management, federal requirements	No	US-focused
CIS Controls	Tactical implementation, prioritization	No	Global

Framework Relationships

                    ┌─────────────────┐
                    │   Regulations   │
                    │ (GDPR, HIPAA)   │
                    └────────┬────────┘
                             │ drives
                    ┌────────▼────────┐
                    │   Frameworks    │
                    │(ISO, NIST, CIS) │
                    └────────┬────────┘
                             │ implements
                    ┌────────▼────────┐
                    │    Controls     │
                    │ (specific tech) │
                    └────────┬────────┘
                             │ evidenced by
                    ┌────────▼────────┐
                    │    Audits       │
                    │ (SOC 2, ISO)    │
                    └─────────────────┘

ISO 27001:2022

Structure Overview

Clauses 4-10: Management System Requirements
├── 4. Context of the organization
├── 5. Leadership
├── 6. Planning
├── 7. Support
├── 8. Operation
├── 9. Performance evaluation
└── 10. Improvement

Annex A: 93 Controls in 4 Themes
├── A.5 Organizational controls (37)
├── A.6 People controls (8)
├── A.7 Physical controls (14)
└── A.8 Technological controls (34)

Key Controls for Development

Control	Title	Implementation
A.5.1	Policies for information security	Document security policies
A.5.15	Access control	RBAC, least privilege
A.5.23	Information security for cloud services	Cloud security controls
A.8.4	Access to source code	Git access, code review
A.8.8	Management of technical vulnerabilities	Vulnerability scanning
A.8.9	Configuration management	IaC, hardening
A.8.25	Secure development lifecycle	SSDLC
A.8.28	Secure coding	OWASP, static analysis
A.8.29	Security testing	DAST, penetration testing
A.8.31	Separation of environments	Dev/Test/Prod isolation

ISMS Implementation Approach

// Control implementation tracking
public class IsmsControlTracker
{
    public record ControlStatus
    {
        public required string ControlId { get; init; } // e.g., "A.8.28"
        public required string ControlTitle { get; init; }
        public required ImplementationStatus Status { get; init; }
        public required string Owner { get; init; }
        public required List<string> Evidence { get; init; }
        public required DateTimeOffset LastReviewDate { get; init; }
        public required DateTimeOffset NextReviewDate { get; init; }
        public string? GapDescription { get; init; }
        public string? RemediationPlan { get; init; }
    }

    public enum ImplementationStatus
    {
        NotApplicable,
        NotImplemented,
        PartiallyImplemented,
        FullyImplemented
    }

    public GapAnalysisReport GenerateGapAnalysis(
        IEnumerable<ControlStatus> controls)
    {
        var gaps = controls
            .Where(c => c.Status != ImplementationStatus.FullyImplemented
                     && c.Status != ImplementationStatus.NotApplicable)
            .OrderBy(c => c.ControlId);

        return new GapAnalysisReport
        {
            TotalControls = controls.Count(),
            FullyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.FullyImplemented),
            PartiallyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.PartiallyImplemented),
            NotImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.NotImplemented),
            NotApplicable = controls.Count(c =>
                c.Status == ImplementationStatus.NotApplicable),
            Gaps = gaps.ToList()
        };
    }
}

SOC 2

Trust Services Criteria (TSC)

Category	Description	Key Criteria
Security (Required)	System protected against unauthorized access	CC6.x
Availability	System available for operation	A1.x
Processing Integrity	System processing is complete, accurate	PI1.x
Confidentiality	Confidential information protected	C1.x
Privacy	Personal information protected	P1.x-P8.x

Common Criteria (Security)

CC1 - Control Environment
CC2 - Communication and Information
CC3 - Risk Assessment
CC4 - Monitoring Activities
CC5 - Control Activities
CC6 - Logical and Physical Access Controls
CC7 - System Operations
CC8 - Change Management
CC9 - Risk Mitigation

SOC 2 Control Examples

## CC6.1 - Logical Access Security

### Control Description
The entity implements logical access security software, infrastructure,
and architectures over protected information assets to protect them
from security events to meet the entity's objectives.

### Implementation
- Authentication via Azure AD with MFA required
- RBAC with least privilege principle
- Service accounts with managed identities
- API access via OAuth 2.0 tokens

### Evidence
- Azure AD configuration export
- Role assignment documentation
- Access review reports (quarterly)
- MFA enforcement policy

Type I vs Type II

Aspect	Type I	Type II
Scope	Point in time	Period of time (6-12 months)
Focus	Design of controls	Design AND operating effectiveness
Evidence	Policies, configurations	Logs, samples, testing
Use Case	First audit, quick report	Customer assurance, ongoing

NIST Cybersecurity Framework 2.0

Core Functions

┌────────────────────────────────────────────────────┐
│                      GOVERN                         │
│   Organizational context, strategy, oversight       │
├────────────┬────────────┬────────────┬─────────────┤
│  IDENTIFY  │  PROTECT   │   DETECT   │   RESPOND   │
│  Assets &  │ Safeguards │ Continuous │  Incident   │
│   Risks    │            │ Monitoring │  Response   │
├────────────┴────────────┴────────────┴─────────────┤
│                      RECOVER                        │
│             Resilience & Recovery                   │
└────────────────────────────────────────────────────┘

Function Breakdown

Function	Category	Key Activities
GOVERN	Organizational Context	Establish risk management strategy
	Risk Management Strategy	Define risk tolerance
	Roles & Responsibilities	Assign accountability
	Policy	Document policies
	Oversight	Board/executive involvement
IDENTIFY	Asset Management	Inventory systems and data
	Risk Assessment	Identify and assess risks
	Improvement	Continuous improvement
PROTECT	Identity Management	Access control, authentication
	Awareness & Training	Security training
	Data Security	Encryption, classification
	Platform Security	Secure configurations
	Technology Infrastructure	Secure architecture
DETECT	Continuous Monitoring	Security monitoring
	Adverse Event Analysis	Threat detection
RESPOND	Incident Management	Incident response
	Incident Analysis	Root cause analysis
	Incident Response	Containment, eradication
	Incident Mitigation	Limit impact
RECOVER	Incident Recovery	Restore operations
	Improvements	Post-incident learning

Implementation Tiers

Tier	Name	Description
1	Partial	Ad hoc, reactive
2	Risk Informed	Risk aware but informal
3	Repeatable	Formal policies, consistent
4	Adaptive	Continuous improvement, predictive

CIS Controls v8

Control Categories

Implementation Groups (IG):
IG1 - Essential Cyber Hygiene (56 safeguards)
IG2 - IG1 + Enhanced (130 safeguards)
IG3 - IG1 + IG2 + Advanced (153 safeguards)

18 Control Areas

#	Control	IG1	Key Safeguards
1	Inventory of Enterprise Assets	✓	Asset discovery, inventory
2	Inventory of Software Assets	✓	Software inventory
3	Data Protection	✓	Classification, encryption
4	Secure Configuration	✓	Hardening, baselines
5	Account Management	✓	Centralized auth, MFA
6	Access Control Management	✓	Least privilege, RBAC
7	Continuous Vulnerability Management	✓	Scanning, patching
8	Audit Log Management	✓	Centralized logging
9	Email and Web Browser Protections	✓	Filtering, sandboxing
10	Malware Defenses	✓	Anti-malware, EDR
11	Data Recovery	✓	Backups, testing
12	Network Infrastructure Management		Segmentation, hardening
13	Network Monitoring and Defense		IDS/IPS, NDR
14	Security Awareness and Skills Training	✓	Training program
15	Service Provider Management		Vendor assessment
16	Application Software Security		SSDLC, testing
17	Incident Response Management		IR plan, testing
18	Penetration Testing		Annual pen test

Priority Implementation

## CIS IG1 Priority Controls

### Start Here (Quick Wins)
1. **Control 1.1**: Maintain accurate asset inventory
2. **Control 4.1**: Establish secure configuration process
3. **Control 5.1**: Establish centralized account management
4. **Control 6.1**: Establish access granting process

### Next Priority
5. **Control 7.1**: Establish vulnerability management process
6. **Control 8.1**: Establish audit logging
7. **Control 11.1**: Establish data recovery practices
8. **Control 14.1**: Establish security awareness program

### Then
9. **Control 3.1**: Establish data management process
10. **Control 10.1**: Deploy anti-malware

Cross-Framework Mapping

Control Mapping Matrix

Capability	ISO 27001	SOC 2 TSC	NIST CSF 2.0	CIS v8
Access Control	A.5.15, A.8.2-8.5	CC6.1-6.3	PR.AA	5, 6
Asset Management	A.5.9-5.11	CC6.1	ID.AM	1, 2
Encryption	A.8.24	CC6.1, CC6.7	PR.DS	3.6, 3.9
Logging	A.8.15	CC7.2	DE.AE	8
Vulnerability Mgmt	A.8.8	CC7.1	ID.RA	7
Incident Response	A.5.24-5.28	CC7.4, CC7.5	RS	17
Change Management	A.8.32	CC8.1	PR.IP	4.2
Secure Development	A.8.25-8.31	CC8.1	PR.IP	16

.NET Control Implementation Examples

// Access Control implementation (multiple frameworks)
// ISO 27001 A.5.15 / SOC 2 CC6.1 / NIST PR.AA / CIS 5,6

public class AccessControlService
{
    private readonly IAuthorizationService _authService;
    private readonly IAuditLogger _auditLogger;

    public async Task<AuthorizationResult> Authorize(
        ClaimsPrincipal user,
        string resource,
        string action,
        CancellationToken ct)
    {
        // Log access attempt (CIS 8 / NIST DE.AE)
        var accessAttempt = new AccessAttempt
        {
            UserId = user.GetUserId(),
            Resource = resource,
            Action = action,
            Timestamp = DateTimeOffset.UtcNow
        };

        var result = await _authService.AuthorizeAsync(user, resource, action);

        accessAttempt.Success = result.Succeeded;
        accessAttempt.Reason = result.Failure?.FailureReasons
            .FirstOrDefault()?.Message;

        await _auditLogger.Log(accessAttempt, ct);

        return result;
    }
}

// Secure configuration (ISO A.8.9 / NIST PR.IP / CIS 4)
public class SecureConfigurationValidator
{
    public ValidationResult ValidateConfiguration(IConfiguration config)
    {
        var issues = new List<ConfigurationIssue>();

        // Check for secure defaults
        if (config["AllowHttp"] == "true")
        {
            issues.Add(new ConfigurationIssue
            {
                Setting = "AllowHttp",
                Issue = "HTTP should be disabled in production",
                Severity = Severity.High,
                Remediation = "Set AllowHttp=false"
            });
        }

        // Check TLS configuration
        var tlsVersion = config["MinTlsVersion"];
        if (tlsVersion != "1.2" && tlsVersion != "1.3")
        {
            issues.Add(new ConfigurationIssue
            {
                Setting = "MinTlsVersion",
                Issue = "TLS 1.2 or higher required",
                Severity = Severity.Critical,
                Remediation = "Set MinTlsVersion=1.2"
            });
        }

        return new ValidationResult { Issues = issues };
    }
}

Framework Selection Guide

Decision Tree

What is your primary driver?

├─ Customer requirement for audit report?
│   ├─ US customers → SOC 2
│   └─ International customers → ISO 27001
│
├─ Regulatory requirement?
│   ├─ US Federal → NIST CSF + FedRAMP
│   └─ Healthcare → HIPAA (use NIST CSF)
│
├─ Starting security program?
│   └─ CIS Controls IG1 (practical starting point)
│
└─ Enterprise-wide ISMS?
    └─ ISO 27001 (comprehensive management system)

Security Framework Checklist

Pre-Assessment

• Identify applicable frameworks
• Determine scope boundaries
• Inventory systems in scope
• Document current controls
• Conduct gap analysis

Control Implementation

• Prioritize gaps by risk
• Create remediation roadmap
• Implement missing controls
• Document evidence
• Test control effectiveness

Audit Preparation

• Collect evidence artifacts
• Prepare control narratives
• Test samples (Type II)
• Address known gaps
• Brief stakeholders

Cross-References

• Data Privacy: gdpr-compliance, hipaa-compliance for data protection
• PCI: pci-dss-compliance for payment security
• AI: ai-governance for AI-specific controls

Resources

• ISO 27001:2022
• AICPA SOC 2
• NIST CSF 2.0
• CIS Controls v8