Security frameworks Guides | Governance Docs

TISAX assessment levels explained: what AL 1, AL 2, AL 2.5 and AL 3 involve, which of the…

How to build an AI risk register: the 12 fields, 7 AI risk sources, scoring, and how it…

The 5 vulnerability management metrics that matter — exposure, MTTR by severity, SLA adherence, backlog age, scan coverage…

Cyber risk quantification with FAIR: the factors from threat event frequency to loss magnitude, the 5 indicators it…

NIST SP 800-55 (December 2024, two volumes): the 4 measure types, the 10 documentation fields, what makes a…

MTTD vs MTTR explained as 4 clocks on one incident timeline — detect, acknowledge, contain, recover — with…

Board cybersecurity reporting built on 6 indicators — exposure, control coverage, detection and response speed, incident impact, third-party…

CMMC Phase 2 was due 10 November 2026 and was suspended on 13 July 2026. What stopped, what…

CMMC scoping under 32 CFR 170.19: the 5 Level 2 asset categories and how each is assessed, the…

What a C3PAO must be under 32 CFR 170.9, six checks before you sign, what the Level 2…

CMMC Level 3 explained: all 24 NIST SP 800-172 requirements with DoD parameters, the Final Level 2 (C3PAO)…

CMMC Level 1 explained: the 15 FAR 52.204-21 requirements mapped to 800-171A, the annual self-assessment and SPRS affirmation,…

Category: Security frameworks