Security Control & Tactical Frameworks

The control and tactical frameworks are the family of standards and prioritised guidance used to design, assess, and evidence an organisation's security controls. They answer the question "what should we do to defend ourselves?" — distinct from adversary-behaviour frameworks such as Mitre Attack and the Cyber Kill Chain, which describe what the adversary does.

Overview

These frameworks are organised controls and processes, used for compliance, risk management, and practical hardening. The most relevant to this wiki's domain:

Relationship to ATT&CK & the Kill Chain

• Adversary frameworks describe the threat — TTPs and attack lifecycle stages
• Control frameworks prescribe the defence — the controls to put in place
• The two are joined by mapping: each control (e.g. an Essential Eight mitigation) can be mapped to the ATT&CK techniques it prevents and the Cyber Kill Chain stage it interrupts
• This mapping is the basis of gap analysis: identifying techniques with no controlling mitigation, and control validation: testing that the control actually blocks the mapped technique

Use in the Intelligence / Assessment Lifecycle

• Compliance evidence — demonstrating adherence to a standard or regulation (e.g. ISO 27001 certification, Nis2 Directive, Soci Act)
• Baseline hardening — applying a prioritised, achievable control set (CIS Controls, Essential Eight) rather than a full standards labrum
• Maturity assessment — measuring security posture against a framework's progression levels
• Framing intelligence for decision-makers — expressing recommended actions in the control language boards and executives already expect

Limitations

• Not adversary-specific: controls describe general good practice, not the specific techniques of a named threat actor — hence the need to combine them with Mitre Attack
• Compliance ≠ security: passing a control audit does not guarantee protection against a determined adversary; control validation is required
• Fragmentation: multiple overlapping frameworks create ambiguity about which to adopt; organisations typically align on a primary standard and supplement it

Australian Angle

Australia has a strong domestic control landscape:

• The ACSC Essential Eight is the prioritised baseline — eight mitigations (application whitelisting, patching, MFA, restrict admin privileges, macro security, user-application hardening, daily backups, and email/web filtering) that map cleanly onto ATT&CK techniques and Kill Chain stages
• The Information Security Manual (ISM) and Essential Eight Maturity Model guide government and critical-infrastructure baseline settings
• The Soci Act imposes positive security obligations on Australian critical-infrastructure operators, which are operationalised largely through these control frameworks
• This is the working vocabulary for the assurance and assessment products delivered by the CyberCX Assessments team to Australian clients

Related Pages

• Mitre Attack — the adversary-behaviour framework these controls are mapped against
• Cyber Kill Chain — the lifecycle model for placing controls stage-by-stage
• D3Fend — the countermeasure knowledge base that sits between controls and techniques
• Nis2 Directive — a comparable international regulatory framework
• Uk Cyber Shield — a national cyber-resilience model that relies on these control baselines