1. INFORMATION GOVERNANCE-RISK-SECURITY-COMPLIANCE
GOVERNANCE
 COBIT - ISACA
 ITIL V3 - HM Government
 ISO-38500 - ISO
 CSF - HITRUST
 ITSM - HM Government
RISK MANAGEMENT
 COSO-ERM - Committee of Sponsoring Orgs
 ISO-31000/31010 – ISO
 ITAF – ISACA
GOVERNMENT
 FISMA - Fed Info Security Mgt Act
 FIPS – Fed Info Processing Stand (14)
 FIPS 200 - Min Security Requirements
 CIP 1-9 – NERC CIP-007 Sys Security Mgt.
 DIACAP - DoD In Ass Cert Accred. Proces
REGULATORY /COMPLIANCE
 GLBA – 8 Government Agencies
 BASE II - Basel Committee Banking Supervisn
 SOX 404 – SEC - Public Acct Oversight Board
 SAS 70 / SSAE16 - Auditing Standards Board
 PCI-DSS - PCI-SSC
 HIPAA - Health and Human Services (HHS)
 OMNIBUS RULE – HITECH
 SAFE HARBOR
 EU DIRECTIVE 95/46
 CBPR – Cross Border Privacy Rules (APEC)
 E-DISCOVERY
 FACTA-RED FLAGS
 CALIFORNIA SB 1386
QUALITY MANAGEMENT / SDLC
 CMMI - Carnegie-Mellon University
Capability Maturity Model Integration
 OGRCM3 - SOMAP
Open Governance, Risk and Compliance
Maturity Management Methodology
RISK ASSESSMENT METHODOLOGY
 COBRA - C&A Systems Security
Consultative, Objective Bi-functional Risk Analysis
 OCTAVE - CERT
Operationally Critical Threat, Asset, Vuln Eval
 CRAMM - CCTA
CCTA Risk Analysis and Management Method
 SPRINT - Information Security Forum
Simplified Process for Risk Identification
 SP800-30 - NIST
Guide to Conducting Risk Assessments
 ISSAF – OISSG
Information Sys Sec Assessment Framework
 IAM – NSA
INFOSEC Assessment Methodology
 ISAM – ISAM
Information-Sec Assessment Methodology
RISK ANALYSIS
 FAIR - The Open Group
Factor Analysis of information Risk
 FRAP - Carnegie-Mellon University
Facilitated Risk Analysis Process
VULNERABILITY / SECURITY ASSESSMENT
 OSSTM - ISECOM
Open Source Security Testing Methodology Manual
 Common Criteria - ISO/IEC 15408
STANDARDS GUIDELINES BEST PRACTICE
 ISO-27002 – ISO
 COMMON CRITERIA - App Sec Review
 OWASP – Top 10 & Cheat sheets
 NIST – ALL
 SP800-53 – NIST – Security Management
 CIS