security-frameworks

What this skill does

# Security Frameworks Planning

Comprehensive guidance for security framework alignment and control mapping before development begins.

## When to Use This Skill

- Preparing for ISO 27001 certification
- Planning SOC 2 Type I or Type II audits
- Implementing NIST Cybersecurity Framework 2.0
- Mapping CIS Controls to your environment
- Creating cross-framework control mappings

## Framework Comparison

### When to Use Which Framework

| Framework | Best For | Certification? | Geography |
|-----------|----------|---------------|-----------|
| **ISO 27001** | Enterprise ISMS, international recognition | Yes (3rd party) | Global |
| **SOC 2** | SaaS/Cloud providers, customer trust | Yes (CPA firm) | Primarily US |
| **NIST CSF** | Risk management, federal requirements | No | US-focused |
| **CIS Controls** | Tactical implementation, prioritization | No | Global |

### Framework Relationships

```text
                    ┌─────────────────┐
                    │   Regulations   │
                    │ (GDPR, HIPAA)   │
                    └────────┬────────┘
                             │ drives
                    ┌────────▼────────┐
                    │   Frameworks    │
                    │(ISO, NIST, CIS) │
                    └────────┬────────┘
                             │ implements
                    ┌────────▼────────┐
                    │    Controls     │
                    │ (specific tech) │
                    └────────┬────────┘
                             │ evidenced by
                    ┌────────▼────────┐
                    │    Audits       │
                    │ (SOC 2, ISO)    │
                    └─────────────────┘
```

## ISO 27001:2022

### Structure Overview

```text
Clauses 4-10: Management System Requirements
├── 4. Context of the organization
├── 5. Leadership
├── 6. Planning
├── 7. Support
├── 8. Operation
├── 9. Performance evaluation
└── 10. Improvement

Annex A: 93 Controls in 4 Themes
├── A.5 Organizational controls (37)
├── A.6 People controls (8)
├── A.7 Physical controls (14)
└── A.8 Technological controls (34)
```

### Key Controls for Development

| Control | Title | Implementation |
|---------|-------|----------------|
| A.5.1 | Policies for information security | Document security policies |
| A.5.15 | Access control | RBAC, least privilege |
| A.5.23 | Information security for cloud services | Cloud security controls |
| A.8.4 | Access to source code | Git access, code review |
| A.8.8 | Management of technical vulnerabilities | Vulnerability scanning |
| A.8.9 | Configuration management | IaC, hardening |
| A.8.25 | Secure development lifecycle | SSDLC |
| A.8.28 | Secure coding | OWASP, static analysis |
| A.8.29 | Security testing | DAST, penetration testing |
| A.8.31 | Separation of environments | Dev/Test/Prod isolation |

### ISMS Implementation Approach

```csharp
// Control implementation tracking
public class IsmsControlTracker
{
    public record ControlStatus
    {
        public required string ControlId { get; init; } // e.g., "A.8.28"
        public required string ControlTitle { get; init; }
        public required ImplementationStatus Status { get; init; }
        public required string Owner { get; init; }
        public required List<string> Evidence { get; init; }
        public required DateTimeOffset LastReviewDate { get; init; }
        public required DateTimeOffset NextReviewDate { get; init; }
        public string? GapDescription { get; init; }
        public string? RemediationPlan { get; init; }
    }

    public enum ImplementationStatus
    {
        NotApplicable,
        NotImplemented,
        PartiallyImplemented,
        FullyImplemented
    }

    public GapAnalysisReport GenerateGapAnalysis(
        IEnumerable<ControlStatus> controls)
    {
        var gaps = controls
            .Where(c => c.Status != ImplementationStatus.FullyImplemented
                     && c.Status != ImplementationStatus.NotApplicable)
            .OrderBy(c => c.ControlId);

        return new GapAnalysisReport
        {
            TotalControls = controls.Count(),
            FullyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.FullyImplemented),
            PartiallyImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.PartiallyImplemented),
            NotImplemented = controls.Count(c =>
                c.Status == ImplementationStatus.NotImplemented),
            NotApplicable = controls.Count(c =>
                c.Status == ImplementationStatus.NotApplicable),
            Gaps = gaps.ToList()
        };
    }
}
```

## SOC 2

### Trust Services Criteria (TSC)

| Category | Description | Key Criteria |
|----------|-------------|--------------|
| **Security** (Required) | System protected against unauthorized access | CC6.x |
| **Availability** | System available for operation | A1.x |
| **Processing Integrity** | System processing is complete, accurate | PI1.x |
| **Confidentiality** | Confidential information protected | C1.x |
| **Privacy** | Personal information protected | P1.x-P8.x |

### Common Criteria (Security)

```text
CC1 - Control Environment
CC2 - Communication and Information
CC3 - Risk Assessment
CC4 - Monitoring Activities
CC5 - Control Activities
CC6 - Logical and Physical Access Controls
CC7 - System Operations
CC8 - Change Management
CC9 - Risk Mitigation
```

### SOC 2 Control Examples

```markdown
## CC6.1 - Logical Access Security

### Control Description
The entity implements logical access security software, infrastructure,
and architectures over protected information assets to protect them
from security events to meet the entity's objectives.

### Implementation
- Authentication via Azure AD with MFA required
- RBAC with least privilege principle
- Service accounts with managed identities
- API access via OAuth 2.0 tokens

### Evidence
- Azure AD configuration export
- Role assignment documentation
- Access review reports (quarterly)
- MFA enforcement policy
```

### Type I vs Type II

| Aspect | Type I | Type II |
|--------|--------|---------|
| **Scope** | Point in time | Period of time (6-12 months) |
| **Focus** | Design of controls | Design AND operating effectiveness |
| **Evidence** | Policies, configurations | Logs, samples, testing |
| **Use Case** | First audit, quick report | Customer assurance, ongoing |

## NIST Cybersecurity Framework 2.0

### Core Functions

```text
┌────────────────────────────────────────────────────┐
│                      GOVERN                         │
│   Organizational context, strategy, oversight       │
├────────────┬────────────┬────────────┬─────────────┤
│  IDENTIFY  │  PROTECT   │   DETECT   │   RESPOND   │
│  Assets &  │ Safeguards │ Continuous │  Incident   │
│   Risks    │            │ Monitoring │  Response   │
├────────────┴────────────┴────────────┴─────────────┤
│                      RECOVER                        │
│             Resilience & Recovery                   │
└────────────────────────────────────────────────────┘
```

### Function Breakdown

| Function | Category | Key Activities |
|----------|----------|---------------|
| **GOVERN** | Organizational Context | Establish risk management strategy |
| | Risk Management Strategy | Define risk tolerance |
| | Roles & Responsibilities | Assign accountability |
| | Policy | Document policies |
| | Oversight | Board/executive involvement |
| **IDENTIFY** | Asset Management | Inventory systems and data |
| | Risk Assessment | Identify and assess risks |
| | Improvement | Continuous improvement |
| **PROTECT** | Identity Management | Access control, authentication |
| | Awareness & Training | Security training |
| | Data Security | Encryption, classification |
| | Platform Security | Secure configurations |
| | Technology Infrastructure | Secure architecture |
| **DETECT** | Continuous Monitoring | Security monitoring |
| | Adverse Event Analysis | Threat detection |
| **RESPOND** |