Resource Catalog

Information Security Policy

Defines the organization’s approach to protecting information assets, systems, and data across people, process, and technology.

Acceptable Use Policy (AUP)

Baseline acceptable use rules for corporate devices, email, and systems.

AI Acceptable Use Policy

Rules for responsible AI use, approved tools, and data handling for client review.

NIST CSF 2.0

A risk-based framework to understand, assess, prioritize, and communicate cybersecurity outcomes across Identify, Protect, Detect, Respond, and Recover.

CIS Controls v8

A prioritized set of 18 safeguards to reduce the most common cyber risks; practical for SMB and enterprise control implementation.

NIST SP 800-61 Rev. 3

Incident response recommendations and considerations aligned to cybersecurity risk management activities (CSF 2.0 alignment).

ISO/IEC 27001

International standard specifying requirements for an Information Security Management System (ISMS).

SOC 2

Assurance reporting framework for service organizations based on Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy).

MITRE ATT&CK

A knowledge base of adversary tactics and techniques used to drive threat modeling, detection engineering, and threat-informed defense.

NIST AI RMF 1.0

Guidance to manage risks of AI systems and improve trustworthiness across Govern, Map, Measure, and Manage functions.

NIST Privacy Framework

A voluntary framework to help organizations identify and manage privacy risk through enterprise risk management.

GDPR (Regulation (EU) 2016/679)

EU regulation governing personal data protection and privacy rights, including lawful processing, data subject rights, and accountability obligations.

ISO 22301

International standard for Business Continuity Management Systems (BCMS) to build resilience and recover from disruptive incidents.

Incident Response Quick Runbook

A one-page IR checklist for triage, containment, and communications.

Ransomware attack on core business systems

60–90 minute, decision-focused exercise mapped to NIST IR + CIS (8, 17, 18).

Phishing → credential compromise

Identity compromise scenario emphasizing executive decisions for containment and recovery.

Data exfiltration & breach notification

Decisions around containment, forensics, legal counsel, and notification timelines.

Third-party / vendor compromise

Vendor incident handling, contractual obligations, and continuity decision-making.

Insider threat (malicious or negligent)

HR/legal coordination, evidence handling, and containment decisions under pressure.

Business email compromise (BEC)

Fraud response and financial decision-making with comms and recovery sequencing.

Website defacement

Public-facing incident decisions including containment, restoration, and PR messaging.

Cloud service outage

Continuity, vendor escalation, and recovery sequencing decisions during outages.

Malware propagation across endpoints

Isolation tradeoffs, operational impact decisions, and recovery prioritization.

Lost/stolen device with sensitive data

Data exposure, legal obligations, and user/customer communications decisions.

Regulatory & reputational impact discussions

Executive decision-making on disclosure strategy, regulator engagement, and PR.

Backup Failure / Recovery Failure

Decision-making when restoration fails and operations must continue under constraints.

Identity / Privileged Access Compromise

Privileged account abuse decisions, containment steps, and credential reset sequencing.

Shadow IT / Unauthorized SaaS

Discovery, risk acceptance, and containment decisions without deep technical jargon.

Incident Communications Breakdown

Focuses on decision ownership, escalation, and messaging when coordination fails.

Supply Chain / Software Update Compromise

Decisions around vendor trust, rollback strategy, customer impact, and recovery plans.