Metrics & Frameworks
FRAMEWORK LIBRARY
Security Frameworks and Measurement References
Browse commonly used cybersecurity frameworks, standards, and control references with practical context on where they apply and how they support security assessment, compliance, and improvement.
Browse security standards, control models, and measurement references
CIS Critical Security Controls
A prioritized set of cybersecurity controls used to reduce common attack paths and improve practical security maturity.
Overview
CIS Controls provide a practical control set that helps organizations prioritize security activities based on common attack techniques and operational risk.
Where It Applies
Useful for infrastructure reviews, endpoint hardening, configuration audits, security maturity assessments, and internal security improvement programs.
Key Areas
Asset inventory, vulnerability management, secure configuration, access control, audit logging, malware defense, incident response, and data protection.
Castellum Labs Usage
Can be mapped into configuration audit, infrastructure security assessment, cloud review, and control maturity reporting.
ISO/IEC 27001
A globally recognized standard for establishing, maintaining, and improving an information security management system.
Overview
ISO/IEC 27001 focuses on managing information security through policy, risk assessment, controls, responsibilities, and continual improvement.
Where It Applies
Best suited for organizations that need formal governance, certification readiness, customer assurance, and repeatable security management processes.
Key Areas
Security policy, risk treatment, access control, supplier security, incident management, asset protection, business continuity, and compliance.
Castellum Labs Usage
Can support gap assessments, audit preparation, security governance reviews, control mapping, and evidence readiness.
NIST Cybersecurity Framework
A flexible cybersecurity risk framework built around identifying, protecting, detecting, responding, and recovering from cyber risk.
Overview
NIST CSF helps organizations understand cybersecurity posture in a business-readable way across core security functions.
Where It Applies
Useful for board reporting, maturity assessments, cybersecurity program planning, risk scoring, and improvement roadmaps.
Key Areas
Identify, Protect, Detect, Respond, Recover, governance, risk visibility, asset management, and incident readiness.
Castellum Labs Usage
Can be used to structure security maturity dashboards, executive summaries, gap reports, and roadmap recommendations.
NIST SP 800-53
A detailed catalog of security and privacy controls used for structured control assessment and compliance mapping.
Overview
NIST SP 800-53 provides a large catalog of controls covering governance, technical safeguards, monitoring, privacy, and system security.
Where It Applies
Useful when the client needs detailed control coverage, audit mapping, government-grade control references, or structured security assessment.
Key Areas
Access control, audit and accountability, configuration management, incident response, risk assessment, system integrity, and privacy controls.
Castellum Labs Usage
Can be mapped into control libraries, audit trackers, configuration audit checks, and enterprise security gap assessments.
SOC 2 Trust Services Criteria
A control assurance framework focused on security, availability, confidentiality, processing integrity, and privacy.
Overview
SOC 2 evaluates controls around security and trust services criteria, commonly used by SaaS and service organizations.
Where It Applies
Useful for organizations that need customer assurance, vendor due diligence readiness, CPA audit preparation, and evidence mapping.
Key Areas
Security, availability, confidentiality, processing integrity, privacy, access management, monitoring, vendor risk, and change management.
Castellum Labs Usage
Can be used for SOC 2 readiness assessments, evidence review, control evaluation, gap tracking, and audit support reporting.
PCI DSS
A payment security standard focused on protecting cardholder data and securing payment processing environments.
Overview
PCI DSS defines security requirements for organizations that store, process, or transmit cardholder data.
Where It Applies
Relevant for payment gateways, e-commerce systems, card processing environments, payment applications, and supporting infrastructure.
Key Areas
Network security, access control, vulnerability management, logging, secure development, encryption, monitoring, and cardholder data protection.
Castellum Labs Usage
Can support payment application testing, infrastructure assessment, segmentation review, and compliance readiness evaluation.
GDPR
A privacy regulation focused on personal data protection, lawful processing, data subject rights, and privacy governance.
Overview
GDPR defines privacy requirements for personal data processing, accountability, transparency, consent, security, and data subject rights.
Where It Applies
Relevant when organizations process personal data of EU residents or need privacy-aligned data governance and breach response.
Key Areas
Lawful processing, data minimization, privacy notices, breach notification, access rights, retention, processors, and security measures.
Castellum Labs Usage
Can support privacy control reviews, breach readiness, data protection gap assessments, and evidence mapping for privacy programs.
MITRE ATT&CK
A knowledge base of adversary tactics and techniques used for threat modeling, detection engineering, and security testing.
Overview
MITRE ATT&CK organizes adversary behavior into tactics, techniques, and procedures that help teams understand real-world attack patterns.
Where It Applies
Useful for detection engineering, red teaming, purple teaming, SOC coverage mapping, incident analysis, and threat intelligence reporting.
Key Areas
Initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, and exfiltration.
Castellum Labs Usage
Can support attack simulation, detection coverage reviews, SOC maturity assessment, and threat-informed security testing.
OWASP ASVS
An application security verification standard used to assess web and API security controls with structured requirements.
Overview
OWASP ASVS provides detailed application security requirements that help standardize testing, verification, and secure design expectations.
Where It Applies
Useful for web application testing, API assessment, secure SDLC programs, application control reviews, and security acceptance criteria.
Key Areas
Authentication, session management, access control, validation, cryptography, error handling, data protection, API security, and configuration.
Castellum Labs Usage
Can strengthen AppSec test libraries, secure code review checklists, API testing methods, and application risk reporting.
OWASP SAMM
A software assurance maturity model used to evaluate and improve secure software delivery practices over time.
Overview
OWASP SAMM helps organizations measure and improve software assurance practices across governance, design, implementation, verification, and operations.
Where It Applies
Useful for secure SDLC assessments, AppSec maturity reviews, product security roadmap planning, and engineering security governance.
Key Areas
Governance, design, implementation, verification, operations, policy, threat assessment, secure build, testing, and defect management.
Castellum Labs Usage
Can support AppSec maturity assessments, secure SDLC consulting, engineering security reviews, and roadmap development.
Get started today!
To know more and to setup an experiential demo
