Security Frameworks

Security Frameworks Planning

Comprehensive guidance for security framework alignment and control mapping before development begins.

When to Use This Skill

• Preparing for ISO 27001 certification
• Planning SOC 2 Type I or Type II audits
• Implementing NIST Cybersecurity Framework 2.0
• Mapping CIS Controls to your environment
• Creating cross-framework control mappings

Framework Comparison

When to Use Which Framework

Framework Relationships

                    ┌─────────────────┐
                    │   Regulations   │
                    │ (GDPR, HIPAA)   │
                    └────────┬────────┘
                             │ drives
                    ┌────────▼────────┐
                    │   Frameworks    │
                    │(ISO, NIST, CIS) │
                    └────────┬────────┘
                             │ implements
                    ┌────────▼────────┐
                    │    Controls     │
                    │ (specific tech) │
                    └────────┬────────┘
                             │ evidenced by
                    ┌────────▼────────┐
                    │    Audits       │
                    │ (SOC 2, ISO)    │
                    └─────────────────┘

ISO 27001:2022

Structure Overview

Clauses 4-10: Management System Requirements
├── 4. Context of the organization
├── 5. Leadership
├── 6. Planning
├── 7. Support
├── 8. Operation
├── 9. Performance evaluation
└── 10. Improvement

Annex A: 93 Controls in 4 Themes
├── A.5 Organizational controls (37)
├── A.6 People controls (8)
├── A.7 Physical controls (14)
└── A.8 Technological controls (34)

Key Controls for Development

ISMS Implementation Approach

// Control implementation tracking
public class IsmsControlTracker
{
    public record ControlStatus
    {
        public required string ControlId { get; init; } // e.g., "A.8.28"
        public required string ControlTitle { get; init; }
        public required ImplementationStatus Status { get; init; }
        public required string Owner { get; init; }
        public required List<string> Evidence { get; init; }
        public required DateTimeOffset LastReviewDate { get; init; }
        public required DateTimeOffset NextReviewDate { get; init; }
        public string? GapDescription { get; init; }
        public string? RemediationPlan { get; init; }
    }

    public enum ImplementationStatus
    {
        NotApplicable,
        NotImplemented,
        PartiallyImplemented,
        FullyImplemented
    }

    public GapAnalysisReport GenerateGapAnalysis(
        IEnumerable<ControlStatus> controls)
    {
        var gaps = controls
            .Where(c => c.Status != ImplementationStatus.FullyImplemented
                     && c.Status != ImplementationStatus.NotApplicable)
            .OrderBy(c => c.ControlId);

        return new GapAnalysisReport
        {
            TotalControls = controls.Count(),
            FullyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.FullyImplemented),
            PartiallyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.PartiallyImplemented),
            NotImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.NotImplemented),
            NotApplicable = controls.Count(c =>
                c.Status == ImplementationStatus.NotApplicable),
            Gaps = gaps.ToList()
        };
    }
}

SOC 2

Trust Services Criteria (TSC)

Common Criteria (Security)

CC1 - Control Environment
CC2 - Communication and Information
CC3 - Risk Assessment
CC4 - Monitoring Activities
CC5 - Control Activities
CC6 - Logical and Physical Access Controls
CC7 - System Operations
CC8 - Change Management
CC9 - Risk Mitigation

SOC 2 Control Examples

## CC6.1 - Logical Access Security

### Control Description
The entity implements logical access security software, infrastructure,
and architectures over protected information assets to protect them
from security events to meet the entity's objectives.

### Implementation
- Authentication via Azure AD with MFA required
- RBAC with least privilege principle
- Service accounts with managed identities
- API access via OAuth 2.0 tokens

### Evidence
- Azure AD configuration export
- Role assignment documentation
- Access review reports (quarterly)
- MFA enforcement policy

Type I vs Type II

NIST Cybersecurity Framework 2.0

Core Functions

┌────────────────────────────────────────────────────┐
│                      GOVERN                         │
│   Organizational context, strategy, oversight       │
├────────────┬────────────┬────────────┬─────────────┤
│  IDENTIFY  │  PROTECT   │   DETECT   │   RESPOND   │
│  Assets &  │ Safeguards │ Continuous │  Incident   │
│   Risks    │            │ Monitoring │  Response   │
├────────────┴────────────┴────────────┴─────────────┤
│                      RECOVER                        │
│             Resilience & Recovery                   │
└────────────────────────────────────────────────────┘

Function Breakdown

Implementation Tiers

CIS Controls v8

Control Categories

Implementation Groups (IG):
IG1 - Essential Cyber Hygiene (56 safeguards)
IG2 - IG1 + Enhanced (130 safeguards)
IG3 - IG1 + IG2 + Advanced (153 safeguards)

18 Control Areas

Priority Implementation

## CIS IG1 Priority Controls

### Start Here (Quick Wins)
1. **Control 1.1**: Maintain accurate asset inventory
2. **Control 4.1**: Establish secure configuration process
3. **Control 5.1**: Establish centralized account management
4. **Control 6.1**: Establish access granting process

### Next Priority
5. **Control 7.1**: Establish vulnerability management process
6. **Control 8.1**: Establish audit logging
7. **Control 11.1**: Establish data recovery practices
8. **Control 14.1**: Establish security awareness program

### Then
9. **Control 3.1**: Establish data management process
10. **Control 10.1**: Deploy anti-malware

Cross-Framework Mapping

Control Mapping Matrix

.NET Control Implementation Examples

// Access Control implementation (multiple frameworks)
// ISO 27001 A.5.15 / SOC 2 CC6.1 / NIST PR.AA / CIS 5,6

public class AccessControlService
{
    private readonly IAuthorizationService _authService;
    private readonly IAuditLogger _auditLogger;

    public async Task<AuthorizationResult> Authorize(
        ClaimsPrincipal user,
        string resource,
        string action,
        CancellationToken ct)
    {
        // Log access attempt (CIS 8 / NIST DE.AE)
        var accessAttempt = new AccessAttempt
        {
            UserId = user.GetUserId(),
            Resource = resource,
            Action = action,
            Timestamp = DateTimeOffset.UtcNow
        };

        var result = await _authService.AuthorizeAsync(user, resource, action);

        accessAttempt.Success = result.Succeeded;
        accessAttempt.Reason = result.Failure?.FailureReasons
            .FirstOrDefault()?.Message;

        await _auditLogger.Log(accessAttempt, ct);

        return result;
    }
}

// Secure configuration (ISO A.8.9 / NIST PR.IP / CIS 4)
public class SecureConfigurationValidator
{
    public ValidationResult ValidateConfiguration(IConfiguration config)
    {
        var issues = new List<ConfigurationIssue>();

        // Check for secure defaults
        if (config["AllowHttp"] == "true")
        {
            issues.Add(new ConfigurationIssue
            {
                Setting = "AllowHttp",
                Issue = "HTTP should be disabled in production",
                Severity = Severity.High,
                Remediation = "Set AllowHttp=false"
            });
        }

        // Check TLS configuration
        var tlsVersion = config["MinTlsVersion"];
        if (tlsVersion != "1.2" && tlsVersion != "1.3")
        {
            issues.Add(new ConfigurationIssue
            {
                Setting = "MinTlsVersion",
                Issue = "TLS 1.2 or higher required",
                Severity = Severity.Critical,
                Remediation = "Set MinTlsVersion=1.2"
            });
        }

        return new ValidationResult { Issues = issues };
    }
}

Framework Selection Guide

Decision Tree

What is your primary driver?

├─ Customer requirement for audit report?
│   ├─ US customers → SOC 2
│   └─ International customers → ISO 27001
│
├─ Regulatory requirement?
│   ├─ US Federal → NIST CSF + FedRAMP
│   └─ Healthcare → HIPAA (use NIST CSF)
│
├─ Starting security program?
│   └─ CIS Controls IG1 (practical starting point)
│
└─ Enterprise-wide ISMS?
    └─ ISO 27001 (comprehensive management system)

Security Framework Checklist

Pre-Assessment

• Identify applicable frameworks
• Determine scope boundaries
• Inventory systems in scope
• Document current controls
• Conduct gap analysis

Control Implementation

• Prioritize gaps by risk
• Create remediation roadmap
• Implement missing controls
• Document evidence
• Test control effectiveness

Audit Preparation

• Collect evidence artifacts
• Prepare control narratives
• Test samples (Type II)
• Address known gaps
• Brief stakeholders

Cross-References

• Data Privacy: gdpr-compliance, hipaa-compliance for data protection
• PCI: pci-dss-compliance for payment security
• AI: ai-governance for AI-specific controls

Resources

• ISO 27001:2022
• AICPA SOC 2
• NIST CSF 2.0
• CIS Controls v8