security_principles_reference.oscal.json

{
  "catalog": {
    "uuid": "b7e2a9f0-1c3d-4e5f-8a6b-1234567890ab",
    "metadata": {
      "title": "Security Principles, Axioms, and Invariables Reference",
      "version": "2.1.0",
      "oscal-version": "1.1.2",
      "last-modified": "2026-07-26T00:00:00Z",
      "remarks": "A reference catalog of classical, framework-agnostic security engineering axioms and traditional information-security standards: Saltzer and Schroeder (1975), NIST SP 800-27, ISO/IEC 27001:2022, the CIS Critical Security Controls v8/v8.1, Microsoft's two law sets, and industry-synthesized cloud architecture corollaries. As of version 2.0.0, AI- and agentic-security-specific sources (frontier labs, OWASP, CoSAI, CSA, MITRE ATLAS, BIML, the OECD, ISO/IEC AI standards, and related material) were split out into a companion catalog, ai_agentic_security_principles.json, so that a fast-moving, open-ended corpus would not force repeated churn on this stable reference. Several 'related' links in this file point into that companion catalog using a filename-qualified href (e.g. 'ai_agentic_security_principles.json#id'); cross-framework 'related' links generally reflect a first-pass manual clustering and should be refined against the live OpenCRE catalog before final CRE-ID mapping."
    },
    "groups": [
      {
        "id": "saltzer-schroeder",
        "title": "Saltzer and Schroeder Engineering Axioms (1975)",
        "props": [
          {
            "name": "publisher",
            "value": "Saltzer, J.H. and Schroeder, M.D., Proceedings of the IEEE, 1975"
          }
        ],
        "controls": [
          {
            "id": "sch-1",
            "title": "Least privilege",
            "parts": [
              {
                "name": "statement",
                "prose": "Grant the minimum access needed, nothing more."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "access-control"
              }
            ],
            "links": [
              {
                "href": "#nist-p26",
                "rel": "related"
              },
              {
                "href": "#cis18-6",
                "rel": "related"
              }
            ]
          },
          {
            "id": "sch-2",
            "title": "Fail-safe defaults",
            "parts": [
              {
                "name": "statement",
                "prose": "Deny by default when a decision is ambiguous or a control fails."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "access-control"
              }
            ]
          },
          {
            "id": "sch-3",
            "title": "Complete mediation",
            "parts": [
              {
                "name": "statement",
                "prose": "Check every access to every object, every time."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "access-control"
              }
            ],
            "links": [
              {
                "href": "#nist-p32",
                "rel": "related"
              }
            ]
          },
          {
            "id": "sch-4",
            "title": "Economy of mechanism",
            "parts": [
              {
                "name": "statement",
                "prose": "Keep designs small and simple enough to verify."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "design"
              }
            ],
            "links": [
              {
                "href": "#nist-p24",
                "rel": "related"
              }
            ]
          },
          {
            "id": "sch-5",
            "title": "Open design",
            "parts": [
              {
                "name": "statement",
                "prose": "Security should not depend on secrecy of the design (Kerckhoffs's principle)."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "design"
              }
            ],
            "links": [
              {
                "href": "#nist-p12",
                "rel": "related"
              }
            ]
          },
          {
            "id": "sch-6",
            "title": "Separation of privilege",
            "parts": [
              {
                "name": "statement",
                "prose": "Require more than one condition or party to authorize sensitive actions."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "access-control"
              }
            ]
          },
          {
            "id": "sch-7",
            "title": "Least common mechanism",
            "parts": [
              {
                "name": "statement",
                "prose": "Minimize shared state between users or components."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "design"
              }
            ],
            "links": [
              {
                "href": "#nist-p25",
                "rel": "related"
              }
            ]
          },
          {
            "id": "sch-8",
            "title": "Psychological acceptability",
            "parts": [
              {
                "name": "statement",
                "prose": "Controls too painful to use get bypassed by real users."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "human-factors"
              }
            ],
            "links": [
              {
                "href": "#nist-p15",
                "rel": "related"
              },
              {
                "href": "#ms-risk-3",
                "rel": "related"
              }
            ]
          }
        ]
      },
      {
        "id": "nist-sp800-27",
        "title": "NIST SP 800-27 Rev A: Engineering Principles for Information Technology Security",
        "props": [
          {
            "name": "status",
            "value": "withdrawn, superseded by SP 800-160 (2016)"
          },
          {
            "name": "publisher",
            "value": "Stoneburner, Hayden, Feringa, NIST, June 2004"
          }
        ],
        "links": [
          {
            "href": "https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-27ra.pdf",
            "rel": "reference"
          }
        ],
        "groups": [
          {
            "id": "nist-security-foundation",
            "title": "Security Foundation",
            "controls": [
              {
                "id": "nist-p1",
                "title": "Establish a sound security policy as the foundation for design",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Establish a sound security policy as the foundation for design"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "governance"
                  }
                ]
              },
              {
                "id": "nist-p2",
                "title": "Treat security as an integral part of the overall system design",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Treat security as an integral part of the overall system design"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p3",
                "title": "Clearly delineate the physical and logical security boundaries governed by associated security policies",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Clearly delineate the physical and logical security boundaries governed by associated security policies"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p4",
                "title": "Ensure that developers are trained in how to develop secure software",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Ensure that developers are trained in how to develop secure software"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "human-factors"
                  }
                ]
              }
            ]
          },
          {
            "id": "nist-risk-based",
            "title": "Risk Based",
            "controls": [
              {
                "id": "nist-p5",
                "title": "Reduce risk to an acceptable level",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Reduce risk to an acceptable level"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              },
              {
                "id": "nist-p6",
                "title": "Assume that external systems are insecure",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Assume that external systems are insecure"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ],
                "links": [
                  {
                    "href": "#ms-risk-4",
                    "rel": "related"
                  }
                ]
              },
              {
                "id": "nist-p7",
                "title": "Identify potential trade-offs between reducing risk and increased costs or decreased operational effectiveness",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Identify potential trade-offs between reducing risk and increased costs or decreased operational effectiveness"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              },
              {
                "id": "nist-p8",
                "title": "Implement tailored system security measures to meet organizational security goals",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Implement tailored system security measures to meet organizational security goals"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              },
              {
                "id": "nist-p9",
                "title": "Protect information while being processed, in transit, and in storage",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Protect information while being processed, in transit, and in storage"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "data-protection"
                  }
                ]
              },
              {
                "id": "nist-p10",
                "title": "Consider custom products to achieve adequate security",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Consider custom products to achieve adequate security"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              },
              {
                "id": "nist-p11",
                "title": "Protect against all likely classes of attacks",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Protect against all likely classes of attacks"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              }
            ]
          },
          {
            "id": "nist-ease-of-use",
            "title": "Ease Of Use",
            "controls": [
              {
                "id": "nist-p12",
                "title": "Where possible, base security on open standards for portability and interoperability",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Where possible, base security on open standards for portability and interoperability"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p13",
                "title": "Use common language in developing security requirements",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Use common language in developing security requirements"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "governance"
                  }
                ]
              },
              {
                "id": "nist-p14",
                "title": "Design security to allow for regular adoption of new technology, including a secure and logical upgrade process",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Design security to allow for regular adoption of new technology, including a secure and logical upgrade process"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p15",
                "title": "Strive for operational ease of use",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Strive for operational ease of use"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "human-factors"
                  }
                ]
              }
            ]
          },
          {
            "id": "nist-increase-resilience",
            "title": "Increase Resilience",
            "controls": [
              {
                "id": "nist-p16",
                "title": "Implement layered security, ensure no single point of vulnerability",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Implement layered security, ensure no single point of vulnerability"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p17",
                "title": "Design and operate an IT system to limit damage and be resilient in response",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Design and operate an IT system to limit damage and be resilient in response"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p18",
                "title": "Provide assurance that the system is, and continues to be, resilient in the face of expected threats",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Provide assurance that the system is, and continues to be, resilient in the face of expected threats"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p19",
                "title": "Limit or contain vulnerabilities",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Limit or contain vulnerabilities"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p20",
                "title": "Isolate public access systems from mission-critical resources (data, processes, etc.)",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Isolate public access systems from mission-critical resources (data, processes, etc.)"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p21",
                "title": "Use boundary mechanisms to separate computing systems and network infrastructures",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Use boundary mechanisms to separate computing systems and network infrastructures"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p22",
                "title": "Design and implement audit mechanisms to detect unauthorized use and support incident investigations",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Design and implement audit mechanisms to detect unauthorized use and support incident investigations"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "monitoring"
                  }
                ]
              },
              {
                "id": "nist-p23",
                "title": "Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              }
            ]
          },
          {
            "id": "nist-reduce-vulnerabilities",
            "title": "Reduce Vulnerabilities",
            "controls": [
              {
                "id": "nist-p24",
                "title": "Strive for simplicity",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Strive for simplicity"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p25",
                "title": "Minimize the system elements to be trusted",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Minimize the system elements to be trusted"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p26",
                "title": "Implement least privilege",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Implement least privilege"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "access-control"
                  }
                ],
                "links": [
                  {
                    "href": "#sch-1",
                    "rel": "related"
                  },
                  {
                    "href": "#cis18-6",
                    "rel": "related"
                  }
                ]
              },
              {
                "id": "nist-p27",
                "title": "Do not implement unnecessary security mechanisms",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Do not implement unnecessary security mechanisms"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p28",
                "title": "Ensure proper security in the shutdown or disposal of a system",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Ensure proper security in the shutdown or disposal of a system"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "lifecycle"
                  }
                ]
              },
              {
                "id": "nist-p29",
                "title": "Identify and prevent common errors and vulnerabilities",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Identify and prevent common errors and vulnerabilities"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "risk-management"
                  }
                ]
              }
            ]
          },
          {
            "id": "nist-design-with-network-in-mind",
            "title": "Design With Network In Mind",
            "controls": [
              {
                "id": "nist-p30",
                "title": "Implement security through a combination of measures distributed physically and logically",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Implement security through a combination of measures distributed physically and logically"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "resilience"
                  }
                ]
              },
              {
                "id": "nist-p31",
                "title": "Formulate security measures to address multiple overlapping information domains",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Formulate security measures to address multiple overlapping information domains"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "design"
                  }
                ]
              },
              {
                "id": "nist-p32",
                "title": "Authenticate users and processes to ensure appropriate access control decisions both within and across domains",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Authenticate users and processes to ensure appropriate access control decisions both within and across domains"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "identity"
                  }
                ],
                "links": [
                  {
                    "href": "#sch-3",
                    "rel": "related"
                  }
                ]
              },
              {
                "id": "nist-p33",
                "title": "Use unique identities to ensure accountability",
                "parts": [
                  {
                    "name": "statement",
                    "prose": "Use unique identities to ensure accountability"
                  }
                ],
                "props": [
                  {
                    "name": "category",
                    "value": "identity"
                  }
                ],
                "links": [
                  {
                    "href": "#corollary-2",
                    "rel": "related"
                  },
                  {
                    "href": "#ms-immutable-6",
                    "rel": "related"
                  }
                ]
              }
            ]
          }
        ]
      },
      {
        "id": "iso-27001-2022",
        "title": "ISO/IEC 27001:2022",
        "props": [
          {
            "name": "publisher",
            "value": "ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection"
          }
        ],
        "controls": [
          {
            "id": "iso-confidentiality",
            "title": "Confidentiality",
            "parts": [
              {
                "name": "statement",
                "prose": "Information is accessible only to those authorized to have access."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "cia-triad"
              }
            ]
          },
          {
            "id": "iso-integrity",
            "title": "Integrity",
            "parts": [
              {
                "name": "statement",
                "prose": "Data is accurate, complete, and protected from unauthorized alteration."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "cia-triad"
              }
            ]
          },
          {
            "id": "iso-availability",
            "title": "Availability",
            "parts": [
              {
                "name": "statement",
                "prose": "Data and systems are accessible to authorized users when needed."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "cia-triad"
              }
            ]
          },
          {
            "id": "iso-annex-a",
            "title": "Annex A control themes",
            "parts": [
              {
                "name": "statement",
                "prose": "93 controls organized into four themes: organizational, people, physical, and technological."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          },
          {
            "id": "iso-clauses",
            "title": "Management system clauses 4-10",
            "parts": [
              {
                "name": "statement",
                "prose": "Context, leadership, planning, support, operation, performance evaluation, and improvement requirements for the ISMS."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          }
        ]
      },
      {
        "id": "cis-v8-design-principles",
        "title": "CIS Critical Security Controls v8 / v8.1 Design Principles",
        "props": [
          {
            "name": "publisher",
            "value": "Center for Internet Security, cisecurity.org/controls/v8"
          }
        ],
        "controls": [
          {
            "id": "cis-design-1",
            "title": "Offense informs defense",
            "parts": [
              {
                "name": "statement",
                "prose": "Controls are selected, dropped, and prioritized based on real attacker behavior and how to stop it."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ]
          },
          {
            "id": "cis-design-2",
            "title": "Focus",
            "parts": [
              {
                "name": "statement",
                "prose": "Identify the most critical actions to stop the most important attacks; avoid trying to solve every problem."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ]
          },
          {
            "id": "cis-design-3",
            "title": "Feasible",
            "parts": [
              {
                "name": "statement",
                "prose": "Every safeguard must be specific and practical to implement."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          },
          {
            "id": "cis-design-4",
            "title": "Measurable",
            "parts": [
              {
                "name": "statement",
                "prose": "Every control, especially in Implementation Group 1, must have unambiguous, checkable criteria."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          },
          {
            "id": "cis-design-5",
            "title": "Align",
            "parts": [
              {
                "name": "statement",
                "prose": "Coexist with other frameworks (NIST, CSA, MITRE ATT&CK, OWASP) rather than compete with them."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          }
        ]
      },
      {
        "id": "cis-v8-1-controls",
        "title": "CIS Critical Security Controls v8.1 (18 Controls, reference index)",
        "props": [
          {
            "name": "publisher",
            "value": "cisecurity.org/controls/cis-controls-list, verified directly"
          }
        ],
        "controls": [
          {
            "id": "cis18-1",
            "title": "Inventory and Control of Enterprise Assets",
            "parts": [
              {
                "name": "statement",
                "prose": "Inventory and Control of Enterprise Assets"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-2",
            "title": "Inventory and Control of Software Assets",
            "parts": [
              {
                "name": "statement",
                "prose": "Inventory and Control of Software Assets"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-3",
            "title": "Data Protection",
            "parts": [
              {
                "name": "statement",
                "prose": "Data Protection"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-4",
            "title": "Secure Configuration of Enterprise Assets and Software",
            "parts": [
              {
                "name": "statement",
                "prose": "Secure Configuration of Enterprise Assets and Software"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-5",
            "title": "Account Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Account Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-6",
            "title": "Access Control Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Access Control Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-7",
            "title": "Continuous Vulnerability Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Continuous Vulnerability Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-8",
            "title": "Audit Log Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Audit Log Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-9",
            "title": "Email and Web Browser Protections",
            "parts": [
              {
                "name": "statement",
                "prose": "Email and Web Browser Protections"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-10",
            "title": "Malware Defenses",
            "parts": [
              {
                "name": "statement",
                "prose": "Malware Defenses"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-11",
            "title": "Data Recovery",
            "parts": [
              {
                "name": "statement",
                "prose": "Data Recovery"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-12",
            "title": "Network Infrastructure Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Network Infrastructure Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-13",
            "title": "Network Monitoring and Defense",
            "parts": [
              {
                "name": "statement",
                "prose": "Network Monitoring and Defense"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-14",
            "title": "Security Awareness and Skills Training",
            "parts": [
              {
                "name": "statement",
                "prose": "Security Awareness and Skills Training"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-15",
            "title": "Service Provider Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Service Provider Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-16",
            "title": "Application Software Security",
            "parts": [
              {
                "name": "statement",
                "prose": "Application Software Security"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-17",
            "title": "Incident Response Management",
            "parts": [
              {
                "name": "statement",
                "prose": "Incident Response Management"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          },
          {
            "id": "cis18-18",
            "title": "Penetration Testing",
            "parts": [
              {
                "name": "statement",
                "prose": "Penetration Testing"
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "control-category"
              }
            ]
          }
        ]
      },
      {
        "id": "ms-immutable-laws-v2",
        "title": "Microsoft Ten Immutable Laws of Security (v2, 2017)",
        "props": [
          {
            "name": "publisher",
            "value": "Microsoft"
          }
        ],
        "links": [
          {
            "href": "https://github.com/MicrosoftDocs/security/blob/main/security-docs/zero-trust/ten-laws-of-security.md",
            "rel": "reference"
          }
        ],
        "controls": [
          {
            "id": "ms-immutable-1",
            "title": "Untrusted code execution",
            "parts": [
              {
                "name": "statement",
                "prose": "If a bad actor can persuade you to run their program on your computer, it's not solely your computer anymore."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "endpoint-security"
              }
            ]
          },
          {
            "id": "ms-immutable-2",
            "title": "OS alteration",
            "parts": [
              {
                "name": "statement",
                "prose": "If a bad actor can alter the operating system on your computer, it's not your computer anymore."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "endpoint-security"
              }
            ]
          },
          {
            "id": "ms-immutable-3",
            "title": "Physical access",
            "parts": [
              {
                "name": "statement",
                "prose": "If a bad actor has unrestricted physical access to your computer, it's not your computer anymore."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "physical-security"
              }
            ]
          },
          {
            "id": "ms-immutable-4",
            "title": "Active content",
            "parts": [
              {
                "name": "statement",
                "prose": "If you allow a bad actor to run active content on your website, it's not your website anymore."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "web-security"
              }
            ]
          },
          {
            "id": "ms-immutable-5",
            "title": "Weak passwords",
            "parts": [
              {
                "name": "statement",
                "prose": "Weak passwords trump strong security."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "identity"
              }
            ]
          },
          {
            "id": "ms-immutable-6",
            "title": "Administrator trust",
            "parts": [
              {
                "name": "statement",
                "prose": "A computer is only as secure as the administrator is trustworthy."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "identity"
              }
            ],
            "links": [
              {
                "href": "#corollary-2",
                "rel": "related"
              },
              {
                "href": "#corollary-4",
                "rel": "related"
              },
              {
                "href": "#nist-p33",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-immutable-7",
            "title": "Decryption key security",
            "parts": [
              {
                "name": "statement",
                "prose": "Encrypted data is only as secure as its decryption key."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "data-protection"
              }
            ],
            "links": [
              {
                "href": "#nist-p9",
                "rel": "related"
              },
              {
                "href": "#ms-risk-9",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-immutable-8",
            "title": "Malware scanner currency",
            "parts": [
              {
                "name": "statement",
                "prose": "An out-of-date antimalware scanner is only marginally better than no scanner at all."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "endpoint-security"
              }
            ]
          },
          {
            "id": "ms-immutable-9",
            "title": "No absolute anonymity",
            "parts": [
              {
                "name": "statement",
                "prose": "Absolute anonymity isn't practically achievable, either online or offline."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "privacy"
              }
            ]
          },
          {
            "id": "ms-immutable-10",
            "title": "Technology limits",
            "parts": [
              {
                "name": "statement",
                "prose": "Technology isn't a panacea."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "human-factors"
              }
            ],
            "links": [
              {
                "href": "#ms-risk-10",
                "rel": "related"
              }
            ]
          }
        ]
      },
      {
        "id": "ms-cybersecurity-risk-laws",
        "title": "Microsoft Ten Laws of Cybersecurity Risk (companion set, last updated May 2024)",
        "props": [
          {
            "name": "publisher",
            "value": "Microsoft"
          }
        ],
        "links": [
          {
            "href": "https://github.com/MicrosoftDocs/security/blob/main/security-docs/zero-trust/ten-laws-of-security.md",
            "rel": "reference"
          }
        ],
        "controls": [
          {
            "id": "ms-risk-1",
            "title": "Ruin attacker ROI",
            "parts": [
              {
                "name": "statement",
                "prose": "Security success is ruining the attacker's ROI."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ]
          },
          {
            "id": "ms-risk-2",
            "title": "Continuous improvement",
            "parts": [
              {
                "name": "statement",
                "prose": "Not keeping up is falling behind."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ]
          },
          {
            "id": "ms-risk-3",
            "title": "Usability wins",
            "parts": [
              {
                "name": "statement",
                "prose": "Productivity always wins."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "human-factors"
              }
            ],
            "links": [
              {
                "href": "#sch-8",
                "rel": "related"
              },
              {
                "href": "#nist-p15",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-risk-4",
            "title": "Attackers are opportunistic",
            "parts": [
              {
                "name": "statement",
                "prose": "Attackers don't care."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ],
            "links": [
              {
                "href": "#nist-p6",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-risk-5",
            "title": "Prioritization",
            "parts": [
              {
                "name": "statement",
                "prose": "Ruthless prioritization is a survival skill."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "risk-management"
              }
            ]
          },
          {
            "id": "ms-risk-6",
            "title": "Shared responsibility",
            "parts": [
              {
                "name": "statement",
                "prose": "Cybersecurity is a team sport."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "governance"
              }
            ]
          },
          {
            "id": "ms-risk-7",
            "title": "Network distrust",
            "parts": [
              {
                "name": "statement",
                "prose": "Your network isn't as trustworthy as you think it is."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "zero-trust"
              }
            ],
            "links": [
              {
                "href": "#corollary-3",
                "rel": "related"
              },
              {
                "href": "#cis18-13",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-risk-8",
            "title": "Isolation limits",
            "parts": [
              {
                "name": "statement",
                "prose": "Isolated networks aren't automatically secure."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "resilience"
              }
            ]
          },
          {
            "id": "ms-risk-9",
            "title": "Encryption limits",
            "parts": [
              {
                "name": "statement",
                "prose": "Encryption alone isn't a data protection solution."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "data-protection"
              }
            ],
            "links": [
              {
                "href": "#ms-immutable-7",
                "rel": "related"
              },
              {
                "href": "#nist-p9",
                "rel": "related"
              }
            ]
          },
          {
            "id": "ms-risk-10",
            "title": "People and process",
            "parts": [
              {
                "name": "statement",
                "prose": "Technology doesn't solve people and process problems."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "human-factors"
              }
            ],
            "links": [
              {
                "href": "#ms-immutable-10",
                "rel": "related"
              }
            ]
          }
        ]
      },
      {
        "id": "cloud-architecture-corollaries",
        "title": "Cloud Architecture Corollaries (industry-synthesized, not a Microsoft publication)",
        "props": [
          {
            "name": "publisher",
            "value": "Industry synthesis compiled for this project; not officially published by Microsoft"
          }
        ],
        "controls": [
          {
            "id": "corollary-1",
            "title": "Weakest link, including supply chain",
            "parts": [
              {
                "name": "statement",
                "prose": "Security is only as strong as the weakest link, including the third-party supply chain."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "supply-chain"
              }
            ],
            "links": [
              {
                "href": "https://csrc.nist.gov/projects/cyber-supply-chain-risk-management",
                "rel": "reference"
              },
              {
                "href": "#cis18-15",
                "rel": "related"
              },
              {
                "href": "#cis18-16",
                "rel": "related"
              }
            ]
          },
          {
            "id": "corollary-2",
            "title": "Identity compromise cascades",
            "parts": [
              {
                "name": "statement",
                "prose": "If the identity system is compromised, the entire cloud infrastructure is compromised."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "identity"
              }
            ],
            "links": [
              {
                "href": "https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model",
                "rel": "reference"
              },
              {
                "href": "#ms-immutable-6",
                "rel": "related"
              },
              {
                "href": "#nist-p33",
                "rel": "related"
              }
            ]
          },
          {
            "id": "corollary-3",
            "title": "Continuous monitoring over static perimeter",
            "parts": [
              {
                "name": "statement",
                "prose": "Continuous monitoring and response will always beat static perimeter defense."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "zero-trust"
              }
            ],
            "links": [
              {
                "href": "https://csrc.nist.gov/publications/detail/sp/800-207/final",
                "rel": "reference"
              },
              {
                "href": "#ms-risk-7",
                "rel": "related"
              },
              {
                "href": "#cis18-13",
                "rel": "related"
              }
            ]
          },
          {
            "id": "corollary-4",
            "title": "Centralized admin pathway as target",
            "parts": [
              {
                "name": "statement",
                "prose": "Any centralized administrative pathway is a primary target for attackers."
              }
            ],
            "props": [
              {
                "name": "category",
                "value": "identity"
              }
            ],
            "links": [
              {
                "href": "https://attack.mitre.org/matrices/enterprise/cloud/",
                "rel": "reference"
              },
              {
                "href": "#ms-immutable-6",
                "rel": "related"
              }
            ]
          }
        ]
      }
    ]
  }
}