Frameworks
Operationalizing the Standards You Are Already Measured Against
Frameworks describe outcomes. They do not describe how a specific determination gets made under contradictory evidence. That is the gap the decision layer fills, across every function rather than only detection.
NIST Cybersecurity Framework 2.0
Six Functions, Not One
Govern, Identify, Protect, Detect, Respond, and Recover each contain decisions that are currently made informally. Each is instrumented.
Govern
Policy, authority, and accountability are encoded rather than assumed.
- Encodes policy, authority, risk tolerance, and escalation thresholds
- Maps every recommendation to its policy basis
- Records who approved, rejected, or modified a decision
- Detects conflicting policies and unclear control ownership
- Maintains risk acceptance and exception expiration
- Produces tamper-evident decision records
- Measures analyst override and automation failure rates
Identify
An inventory becomes a contextual exposure model.
- Which assets exist and who owns them
- Which identities can reach them
- Which privileges create attack paths
- Which vulnerabilities are actually exploitable
- Which business processes depend on them
- What data they contain
- What downstream systems would be affected
Protect
Controls are selected for current conditions, not for a static baseline.
- Enforces adaptive least privilege
- Recommends just-in-time access
- Limits session scope and duration
- Selects controls based on current threat conditions
- Tests proposed policy changes before deployment
- Identifies conflicting or ineffective controls
- Prevents high-risk actions without sufficient evidence and authority
Detect
Correlation and challenge, not another detection engine.
- Correlates heterogeneous telemetry
- Constructs and challenges incident hypotheses with counterevidence
- Detects contradictions among security products
- Maps behavior to ATT&CK techniques
- Scores confidence and uncertainty
- Prioritizes by expected loss and blast radius
- Separates duplicate alerts from independent corroboration
Respond
The least-disruptive effective action, with authority and rollback attached.
- Ranks possible containment actions
- Simulates operational consequences
- Calculates expected risk reduction
- Selects the least-disruptive effective response
- Requires approval scaled to action severity
- Includes rollback instructions
- Coordinates across identity, endpoint, network, cloud, and data controls
- Preserves evidence for investigation
Recover
Restoration sequenced by dependency and verified against persistence.
- Maps service and business dependencies
- Prioritizes restoration sequences
- Verifies removal of compromised identities and persistence mechanisms
- Compares recovery options
- Monitors for recurrence
- Captures lessons learned
- Updates policy, detection logic, and playbooks from actual outcomes
Alignment with a framework is not a claim of certification or compliance. It describes how the reasoning and governance model maps onto published outcomes.
Zero Trust architecture
Policy Information, Decision, Administration, Enforcement
The reference model separates the point that decides from the point that enforces. Enforcement remains yours across identity, devices, networks, applications and workloads, and data.
| Component | Contribution | Owner |
|---|---|---|
| Policy Information Point | Aggregates and validates identity, device, network, workload, data, threat, and business attributes. | ArtOfTheHack |
| Policy Engine | Receives contextual risk, uncertainty, evidence, and recommended constraints; deep adjudication is invoked for exceptional requests. | Shared |
| Policy Administrator | Produces a signed, bounded, expiring instruction for the existing control platform. | Shared |
| Policy Enforcement Point | Remains the grantee organization IdP, PAM, ZTNA gateway, API gateway, proxy, service mesh, endpoint platform, or cloud control. | Grantee organization |
MITRE ATT&CK and D3FEND
From Suspected Technique to Contextual Countermeasure
ATT&CK provides the behavioral vocabulary. D3FEND provides the defensive graph. Neither is a detection engine, and neither selects a response on its own.
- Map evidence to candidate techniques
- Construct possible adversary sequences
- Determine which techniques are corroborated
- Identify missing telemetry
- Measure detection and control coverage
- Select candidate defensive actions
- Map those actions to D3FEND countermeasures
- Record whether the selected controls worked
Incident response
Response Integrated Across the Lifecycle
Current incident-response guidance treats response as a thread running through preparation, detection, response, and recovery rather than a separate phase.
Preparation
Authority models, approval thresholds, reversibility requirements, and fallback policies are defined before an incident, not negotiated during one.
Execution
Every containment action carries its evidence basis, its simulated consequence, the authority that approved it, and the rollback path if one exists.
Learning
Outcomes return to the decision record so that confidence calibration, detection logic, and playbooks improve from what actually happened.