CIS Controls (opens in a new tab)
Why: Prioritised, actionable safeguards that help teams sequence hardening work by impact.
Evergreen hub Strong start
Last verified 6 September 2026
Open
Frameworks
Recognised frameworks and control sets to structure a programme without reinventing the wheel.
13 current resources
Best starting points
Highest starting-point strength resources in this category.
ISO/IEC 27001 and 27002 (opens in a new tab)
Why: Global ISMS requirements and control guidance underpinning certification and supplier assurance.
Evergreen hub Strong start
Last verified 6 September 2026
Open
MITRE ATT&CK (opens in a new tab)
Why: Living knowledge base of adversary tactics and techniques for threat-informed detection and defence.
Living doc Strong start
Last verified 6 September 2026
Open
Showing 13 resources
CIS Controls (opens in a new tab)
Why: Prioritised, actionable safeguards that help teams sequence hardening work by impact.
Evergreen hub Strong start
Last verified 6 September 2026
Open
ISO/IEC 27001 and 27002 (opens in a new tab)
Why: Global ISMS requirements and control guidance underpinning certification and supplier assurance.
Evergreen hub Strong start
Last verified 6 September 2026
Open
MITRE ATT&CK (opens in a new tab)
Why: Living knowledge base of adversary tactics and techniques for threat-informed detection and defence.
Living doc Strong start
Last verified 6 September 2026
Open
NIST Cybersecurity Framework (CSF) (opens in a new tab)
Why: Widely adopted risk-based framework for organising cyber capability across Identify–Protect–Detect–Respond–Recover.
Evergreen hub Strong start
Last verified 6 September 2026
Open
NIST SP 800-53 Security and Privacy Controls (opens in a new tab)
Why: Authoritative catalogue of security and privacy controls used to design and assess system safeguards.
Living doc Strong start
Last verified 6 September 2026
Open
OWASP Application Security Verification Standard (ASVS) (opens in a new tab)
Why: Practical application security verification standard that turns secure-design expectations into testable requirements for builders, reviewers and assurance teams.
Evergreen hub Strong start
Last verified 6 September 2026
Open
OWASP Top Ten (opens in a new tab)
Why: Canonical web application risk ranking — the shared language practitioners and boards use for the biggest app risks.
Living doc Strong start
Last verified 6 September 2026
Open
CyBOK Knowledge Base (opens in a new tab)
Why: The Cyber Security Body of Knowledge — structured academic and practitioner reference covering the core knowledge areas of the discipline.
Evergreen hub Solid
Last verified 6 September 2026
Open
MITRE D3FEND (opens in a new tab)
Why: Countermeasure knowledge graph that maps defensive techniques against attacker behaviours.
Living doc Solid
Last verified 6 September 2026
Open
MITRE Engage (opens in a new tab)
Why: MITRE active-defence framework for denial, deception and adversary engagement, mapped to ATT&CK for defender planning.
Evergreen hub Solid
Last verified 6 September 2026
Open
NHS Data Security and Protection Toolkit (DSPT) (opens in a new tab)
Why: Mandatory UK health and care self-assessment of data security and information governance practice.
Living doc Solid
Last verified 6 September 2026
Open
Secure Controls Framework (SCF) (opens in a new tab)
Why: Cross-maps many regulatory and security frameworks into one controls set for multi-obligation programmes.
Evergreen hub Solid
Last verified 6 September 2026
Open
ISO/IEC 15408 Common Criteria (opens in a new tab)
Why: International criteria for evaluating IT product security claims in procurement and assurance.
Evergreen hub Useful
Last verified 6 September 2026
Open