🚨ATTENTION🚨 The NIST 800-53 mappings have migrated to the Center’s Mappings Explorer project. See README below. This repository is kept here as an archive.
Six security outcomes an enterprise must achieve to run AI agents, and the controls that evidence them. A draft for public comment.
Universal check identifier system for cross-framework security control mapping
Practitioner-led AI security control framework: 57 controls across 12 NIST AI 600-1 GenAI risk domains, mapped to MITRE ATLAS, in three tiers. Vendor-agnostic, CC BY 4.0.
An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about Security Assessments in Cybersecurity.
Hands-on cybersecurity projects focused on network security monitoring, threat analysis, and implementing defensive security controls.
A beginner Python cyber security project that creates a simple risk register using likelihood, impact and recommended controls.
AWS Continuous Compliance Automation Framework for automated control validation, evidence collection, risk scoring, remediation guidance, and audit-ready reporting across AWS security services.
Control-oriented KQL hunting and evidence queries for Microsoft Sentinel and Defender XDR.
Map ransomware-relevant MITRE ATT&CK techniques to MITRE D3FEND defensive patterns and Platform0-style control tests, with a small data model, resolver CLI, and example kill chain.
Claimed vs detection-backed MITRE ATT&CK coverage on real data: official CIS v8, NIST 800-53 (+800-53B baselines) and CTID framework mappings joined with SigmaHQ rules and their log sources; cross-framework auto-mapping, SPOFs, set-cover recommender, heatmap UI
Cyber governance automation PoC with Python data pipelines, explicit contracts, deterministic data-quality rules, lineage, testing and security-control evidence workflows.
GRC cyber case study: 12 risks, security controls, treatment plan, SoA excerpt and NIST CSF 2.0 profiles, with separate lab evidence.
Runtime-agnostic policy framework for AI agents. Mechanical security controls: three-tier action model, approval artefacts, hash-chained audit, prompt-injection defence.
Cybersecurity GRC reference app for asset inventory, risk scoring, control mapping, evidence tracking, remediation, and executive reporting. Python + Streamlit; read-only synthetic-data demo.
Retrieval question answering over the NIST SP 800-53 catalog, where every claim in an answer is tagged to the control that warrants it and the clause can be read in one click.
Open-source mapping of the CCCS ITSP.10.033-01 Protected B (Medium) security control profile, successor to ITSG-33 Annex 4A Profile 1, to Kubernetes mechanisms.
A runnable synthetic lab showing how changing evidence affects a privileged-access review.
Grundschutz++ catalog as JSONL + Qdrant indexing pipeline for RAG — any OpenAI-compatible embedding server, local or hosted (unofficial)
AAEF: An Action Assurance Control Profile for Agentic AI Systems.
To associate your repository with the security-controls topic, visit your repo's landing page and select "manage topics."