Resources
A curated set of the standards, advisories, and reference material used day-to-day across GRC, cloud security, and CNI/OT engagements.
Interactive tool
Golden Thread — NIST CSF to SyAPS, CAF & ISO mapping tool
Map NIST CSF 2.0 against ONR SyAPS, NCSC CAF v4.0 and ISO 27001:2022, assess your position, record evidence and export a report — free, runs entirely in your browser.
Open Golden ThreadShowing all 35 resources
All resources
Government & National Bodies
NCSC — National Cyber Security Centre
UK government authority for cyber security guidance, advisories, and the Cyber Assessment Framework (CAF).
Government & National Bodies
CISA — Cybersecurity and Infrastructure Security Agency
US federal agency publishing advisories, known exploited vulnerabilities (KEV) catalogue, and CNI guidance.
Government & National Bodies
ONR — Office for Nuclear Regulation
UK nuclear regulator; source for SyAPS (Security Assessment Principles) guidance for CNI operators.
Government & National Bodies
IASME Consortium
Cyber Essentials and Cyber Essentials Plus certification body; scheme guidance and assessor resources.
Frameworks & Standards
ISO/IEC 27001
International standard for information security management systems (ISMS).
Frameworks & Standards
NIST Cybersecurity Framework (CSF)
US NIST framework for managing and reducing cybersecurity risk, widely used as a cross-sector baseline.
Frameworks & Standards
CIS Controls
Center for Internet Security's prioritised set of safeguards for defending against common attacks.
Frameworks & Standards
MITRE ATT&CK
Globally accessible knowledge base of adversary tactics and techniques based on real-world observations.
Frameworks & Standards
MITRE ATT&CK Navigator
Interactive tool for annotating and visualising ATT&CK matrices — detection coverage, threat actor mapping, and gap analysis.
Frameworks & Standards
IEC 62443
Series of standards for security of industrial automation and control systems (IACS) / OT environments.
Frameworks & Standards
Cyber Essentials
UK government-backed scheme (and Cyber Essentials Plus) defining five technical controls against common cyber attacks.
Threat Intelligence & Advisories
Microsoft Security Response Center (MSRC)
Microsoft's security advisories, vulnerability disclosures, and update guide.
Threat Intelligence & Advisories
CISA Known Exploited Vulnerabilities (KEV) Catalog
Authoritative, actively maintained list of vulnerabilities known to be exploited in the wild.
Threat Intelligence & Advisories
NVD — National Vulnerability Database
US government repository of standards-based vulnerability management data, built on CVE.
Threat Intelligence & Advisories
SANS Internet Storm Center
Community-driven early-warning system and daily analysis of emerging threats.
Security News & Media
BleepingComputer
Daily reporting on breaches, ransomware, malware campaigns, and vulnerability disclosures.
Security News & Media
The Hacker News
High-volume coverage of vulnerabilities, breaches, and threat actor activity, often first to report new CVEs.
Security News & Media
Dark Reading
Longstanding security news and analysis covering threats, vulnerabilities, and enterprise defence strategy.
Security News & Media
The Register — Security
UK technology publication with a dedicated security desk covering breaches, vulnerabilities, and industry news.
Security News & Media
Infosecurity Magazine
UK-based security publication covering breaking news, research, and industry analysis.
Security News & Media
Help Net Security
Daily security news, interviews, and research summaries across the industry.
Security News & Media
SecurityAffairs
Independent security blog covering breaches, malware campaigns, and geopolitical cyber threat analysis.
Security News & Media
DataBreachToday
ISMG publication tracking breach disclosures, regulatory response, and incident analysis.
Security News & Media
IT Security Guru
UK-focused security news covering breaches, industry commentary, and vendor research.
Security News & Media
IT Security Week
News roundups covering breaches, vulnerabilities, and the wider security industry.
Security News & Media
Hackread
Cybersecurity and technology news covering breaches, hacking incidents, and privacy.
Security News & Media
Huntress Blog
MDR vendor threat research, with detailed write-ups on incidents observed across SMB/MSP environments.
Security News & Media
Sophos News
Sophos X-Ops threat research, ransomware analysis, and vendor security news.
Training & Research
SANS Institute
Training, certification (GIAC), and research across offensive and defensive security disciplines.
Training & Research
OWASP
Open community producing application security tools, standards, and the OWASP Top 10.
Training & Research
SABSA Institute
Home of the SABSA enterprise security architecture methodology and certification framework.
Vendor Documentation
Microsoft Learn — Security
Official Microsoft documentation for Defender, Sentinel, Entra ID, and the broader security stack.
Vendor Documentation
Azure Security Documentation
Azure-specific security architecture, benchmark, and best-practice documentation.
Vendor Documentation
AWS Security Documentation
Official AWS documentation covering IAM, security services, and the Well-Architected security pillar.
Vendor Documentation
Google Cloud Security Documentation
Google Cloud's security product documentation, best practices, and architecture guidance.