Auto-generated 2026-02-23 — 294 documents

This index includes direct links to files in this repo and source links where available.

• By Content Type
• By Organization

• AICPA SOC for Cybersecurity Overview (2018) · source
• SOC 2 Basics Guide (2018)
• SOC System Type Diagram (2018)
• SOC Ticket Flow Chart (2018)
• Illustrative Cybersecurity Risk Management Report (2020)
• AICPA Trust Service Criteria Description Criteria (2022) · source

• AWS Guide to NYDFS Cybersecurity Regulation (2019)
• AWS Cloud Adoption Framework Overview (2020) · source

• Accenture CyberSecurityConundrum 2016 (2016)
• Accenture RebootingPublicSectorCyberSecurity 2016 (2016)
• Accenture CyberThreatscape 2017 (2017)
• Accenture CyberThreatscape ExecSummary 2017 (2017)
• Accenture CyberThreatscape 2018 (2018)

• AWS Security Automation Samples (ongoing) · source
• AWS Security Services Best Practices (ongoing) · source

• Anthem 20161201 (unknown)

• Cloud Computing Compliance Controls Catalogue (C5) (2019)

• Checkov IaC Security and Compliance Scanner (ongoing) · source

• CIS Controls Version 7 (2018) · source
• AWS CIS Foundations Benchmark (2019) · source
• CIS Controls Version 7.1 (2019) · source
• CIS Small Business Budget for Implementing CIS Controls (2019)
• CIS Controls Cloud Companion Guide (2020)
• CIS Controls v8 Implementation Guide (2021) · source
• CIS Controls 7 1 Mapping to Implementation Groups (unknown)
• CIS Controls 7 1 Mapping to Implementation Groups (unknown)
• CIS Controls Version 7 cc (unknown)
• CIS Controls Version 7 cc (unknown)
• CIS Controls Version 8 (unknown)
• CIS Controls Version 8 (unknown)

• CISA MS ISAC Ransomware Guide (2020) · source
• CISA Fact Sheet Rising Ransomware Threat to OT Assets (2021) · source
• Known Exploited Vulnerabilities Catalog (2026) · source
• CISA Cybersecurity Advisories (Live Feed) (ongoing) · source
• CISA Known Exploited Vulnerabilities Catalog (ongoing) · source
• known exploited vulnerabilities (unknown)

• Cyber Readiness Institute Ransomware Playbook (2020) · source

• CIS Controls v8 (2021) · source
• CIS CAT Centralized Compliance Reporting (ongoing) · source
• CIS CAT Pro Assessor v4 (ongoing) · source

• Cisco AnnualCyberSecurityReport 201802 (unknown)
• Cisco SpecialReport SMB Cybersecurity 201807 (unknown)

• Cloud Custodian Multi Cloud Governance as Code (ongoing) · source

• Cloudflare Documentation (Markdown) (ongoing) · source
• Cloudflare Terraform Provider (ongoing) · source

• Coveware RansomwareReport 2020Q3 (2020)
• Coveware RansomwareReport 2020Q4 (2020)
• Coveware RansomewareReport 2022Q2 (2022)

• CrowdStrike GitHub Organization (ongoing) · source

• ENISA Threat Landscape Report (Annual) (ongoing) · source

• Equifax EX99 StatementofRecord (unknown)
• [Equifax GAO 20180906](breach-reports/Equifax_GAO_ 20180906.md) (unknown)
• Equifax SenateReport 201903 (unknown)

• [Introduction to the FAIR Controls Analytics Model (FAIR CAM)](research/Introduction to the FAIR Controls Analytics Model (FAIR-CAM™)_.md) (2021) · source

• FFIEC CAT Appendix B Mapping to NIST CSF (2015) · source
• FFIEC CAT Appendix C Glossary (2015) · source
• FFIEC Cybersecurity Assessment Tool Cybersecurity Maturity 2017 (2017) · source
• FFIEC Cybersecurity Assessment Tool Inherent Risk Profile 2017 (2017) · source
• FFIEC Cybersecurity Assessment Tool User Guide 2017 (2017) · source
• FFIEC IT Examination Handbook Business Continuity Planning (2019) · source
• FFIEC IT Examination Handbook Information Security (2019) · source
• FFIEC IT Examination Handbook Operations (2019) · source
• FFIEC IT Examination Handbook Outsourcing Technology Services (2019) · source
• FFIEC IT Examination Handbook Supervision of Technology Service Providers (2019) · source
• FFIEC IT Examination Handbook All In One (2019) · source
• FFIEC CCAT v0.2 20190124 (unknown)
• FFIEC CCAT v0.2 20190124 (unknown)
• FFIEC CCAT v2 (unknown)
• FFIEC CCAT v2 (unknown)
• FFIEC Cyber Assessment Tool v2.1 locked (unknown)
• FFIEC Cyber Assessment Tool v2.1 locked (unknown)

• FedRAMP Authorization Boundary Guidance for Cloud Service Providers (2019) · source
• FedRAMP Program Overview (2019) · source

• Do No Harm 2.0 Data Practices and Vulnerable People (2019)

• Health Industry Cybersecurity Practices Resources and Templates (2019) · source
• Health Industry Cybersecurity Practices Vol 2 Large Organizations (2019) · source
• Provider Alignment Report HICP 2019 (2019)
• HHS HIPAA Administrative Safeguards Guidance (2020) · source
• HHS HIPAA Physical Safeguards Guidance (2020) · source
• HHS HIPAA Policies and Procedures Requirements (2020) · source
• HHS HIPAA Policies and Procedures Requirements Guidance (2020) · source
• HHS HIPAA Risk Assessment and Management Guidance (2020) · source
• HHS HIPAA Technical Safeguards Guidance (2020) · source
• HHS NIST CSF and HIPAA Security Rule Crosswalk (2020)
• NIST CSF Healthcare Sector Implementation Guidance (2020)

• Substance Use Disorder Privacy Part 2 IDN Workbook (2017)
• 42 CFR Part 2 How to Exchange Part 2 Records (2020)
• 42 CFR Part 2 Appendix D Consent Form (2020)
• 42 CFR Part 2 Consent for Release of Information (2020) · source
• 42 CFR Part 2 FAQs Confidentiality and Health Information Exchange (2020)
• 42 CFR Part 2 Overview Reference (2020)
• CARES Act Section 3221 Summary 42 CFR Part 2 Amendments (2020)
• Privacy and Confidentiality in Health Care 42 CFR Part 2 (2020)

• [HIPAA Encryption Requirements Guide](tools-templates/hipaajournal.com-HIPAA Encryption Requirements.md) (2020)

• Ponemon StateofSMBCybersecurity 2017 (2017)
• Ponemon CostofDataBreach 2018 (2018)
• Ponemon CostofDataBreach 2019 (2019)
• Ponemon CyberResilientOrganizationReport 2019 (2019)
• Ponemon CostofDataBreach 2020 (2020)
• Ponemon CyberResilientOrganizationReport 2020 (2020)
• Ponemon StateofEndpointSecurity 2020 (2020)
• Ponemon CostofDataBreach 2021 (2021)
• CostofDataBreach 2022 (2022)
• Cost of Data Breach Report 2023 (2023)
• IBM Cost of a Data Breach Report 2023 (2023)

• SPDX SBOM Specification (ongoing) · source

• MITRE ATT&CK Framework (ongoing) · source
• MITRE Cyber Analytics Repository (CAR) (ongoing) · source
• MITRE D3FEND (ongoing) · source

• SOC Overview MSPAlliance 2018 (2018)

• Active Directory Design Guide (2012)
• Azure Policy Definitions (JSON) (ongoing) · source
• Microsoft Security Code Samples (ongoing) · source

• NIST SP 800 115 Technical Guide to Information Security Testing (2008) · source
• NIST SP 800 66 Rev 1 Implementing the HIPAA Security Rule (2008) · source
• NIST SP 800 39 Managing Information Security Risk (2011) · source
• NIST CSF v1.1 2018 04 16 (2018)
• NIST CSF v1.1 2018 04 16 (2018)
• NIST Cybersecurity Framework v1.1 (2018) · source
• NIST SP 1800 5 IT Asset Management (2018) · source
• NIST SP 800 171A Assessing CUI Security Requirements (2018) · source
• NIST SP 800 37 Rev 2 Risk Management Framework (2018) · source
• NIST Privacy Framework Informative References (2019) · source
• NIST Privacy Framework Preliminary Draft (2019) · source
• nist pf preliminary core excel 09.05.2019xlsx (2019)
• nist pf preliminary core excel 09.05.2019xlsx (2019)
• NIST SP 800 171 Assessment Methodology v1.2.1 (2020)
• NIST SP 800 53 Rev 5 Security and Privacy Controls (2020) · source
• NIST SP 800 53 Rev 5 (Security and Privacy Controls) (2020) · source
• NIST SP 800 171 Rev 2 Protecting CUI (2021) · source
• NIST CSF 2.0 Initial Public Draft (2023)
• [NIST CSF 2.0 Implementation Examples](frameworks/CSF 2.0 Implementation Examples.md) (2024)
• NIST Cybersecurity Framework 2.0 (2024) · source
• NIST Cybersecurity Framework 2.0 (2024) · source
• NIST SP 1301 CSF 2.0 Small Business Quick Start Guide (2024) · source
• NIST SP 1302 CSF 2.0 Enterprise Risk Management Quick Start Guide (2024) · source
• NIST SP 1303 CSF 2.0 Getting Started Guide (2024) · source
• NIST National Vulnerability Database (NVD) (ongoing) · source
• NIST OSCAL (Open Security Controls Assessment Language) (ongoing) · source
• NIST OSCAL CLI Tool (ongoing) · source
• NIST OSCAL Content Library (800 53 Controls in JSON/YAML) (ongoing) · source
• NIST Special Publications 800 Series (ongoing) · source
• NIST macOS Security Compliance Project (ongoing) · source
• [CSF 2.0 Implementation Examples](frameworks/CSF 2.0-Implementation_Examples.csv) (unknown)
• [CSF 2.0 Implementation Examples](frameworks/CSF 2.0-Implementation_Examples.md) (unknown)
• NIST CSF GapAssessment TEMPLATE (unknown)
• NIST CSF GapAssessment TEMPLATE (unknown)
• NIST CSF to HIPAA Mapping (unknown)
• NIST CSF to HIPAA Mapping (unknown)
• NIST CSF to sp800 171 mapping (unknown)
• NIST CSF to sp800 171 mapping (unknown)
• NIST sp800 53r5 controls (unknown)
• NIST sp800 53r5 controls (unknown)
• TSC mapping NIST CSF (unknown)
• TSC mapping NIST CSF (unknown)
• csf2 (unknown)
• csf2 (unknown)

• National Security Telecommunications Advisory Committee Ransomware IT Sector Workshop (2021)

• OIG 7 Elements of an Effective Compliance Program (2019) · source

• CycloneDX SBOM Specification (ongoing) · source

• Open Policy Agent (OPA) (ongoing) · source

• PCI DSS SAQ Instructions and Guidelines v3.2.1 (2018) · source
• PCI DSS v3.2 Quick Reference Guide (2018) · source
• PCI DSS v3.2.1 (2018) · source
• PCI DSS v3.2.1 Summary of Changes (2018) · source
• Understanding PCI DSS Self Assessment Questionnaires (2018) · source

• Proofpoint HumanFactor 2018 (2018)
• Proofpoint QuarterlyThreatReport Q1 2018 (2018)
• Proofpoint QuarterlyThreatReport Q2 2018 (2018)
• Proofpoint QuarterlyThreatReport Q3 2018 (2018)
• pfpt us tr data loss landscape report 2024 (2024)
• pfpt us tr state of the phish 2024 (2024)

• CISO Mind Map (2019)
• SANS Internet Storm Center (ongoing) · source

• Secure Controls Framework Repository (ongoing) · source

• SSC 2018Healthcare Report c06 (2018)
• SSC 2019 Healthcare Report (2019)

• Symantec ISTR20 2015 (2015)
• Symantec ISTR SpecialReport EmailThreats 2017 (2017)
• Symantec ISTR22 2017 (2017)
• Symantec ISTR23 2018 (2018)
• Symantec ISTR24 2019 (2019)

• pyTenable Tenable Python SDK (ongoing) · source

• OCR Audit Protocol 2018 (2018)
• OCR Audit Protocol 2018 (2018)
• Chinese Cyber Activity Targeting Managed Service Providers (unknown)
• HIPAA CFR list (unknown)
• HIPAA CFR reference (unknown)
• HIPAA CFR reference spreadsheet (unknown)
• HIPAA CFR reference spreadsheet (unknown)

• ATA 2018 Unclassified Report (2018)
• ATA 2019 Unclassified Report (2019)
• USNI WWTA 2019 (2019)
• ATA 2021 Unclassified Report (2021)
• ATA 2022 Unclassified Report (2022)
• ATA 2023 Unclassified Report (2023)

• HIPAA master mapping (unknown)
• HIPAA master mapping (unknown)

• FSSCC ACAT November 2015 V1 0 TLP WHITE (2015)
• FSSCC ACAT November 2015 V1 0 TLP WHITE (2015)
• BBB StateofCyberSecuritySMB 2017 (2017)
• NTTSecurity GTIR KeyFindings 2017 (2017)
• UK DCMS CyberSecurityBreachesSurvey 2017 (2017)
• 191028 MWB CTNT 2019 Healthcare FINAL (2019)
• Checkpoint cyber security report 2020 (2020)
• Gone Phishing Tournament Global Benchmark Report 2020 (2020)
• AD DesignRecommendations (unknown)
• AuditScripts Critical Security Control Executive Assessment Tool v7.0c (unknown)
• AuditScripts Critical Security Control Executive Assessment Tool v7.0c (unknown)
• AuditScripts Critical Security Control Manual Assessment Tool v7.0b (unknown)
• AuditScripts Critical Security Control Manual Assessment Tool v7.0b (unknown)
• AuditScripts Critical Security Control Master Mappings v7.0d (unknown)
• AuditScripts Critical Security Control Master Mappings v7.0d (unknown)
• CSIS SignificantCyberEventsList 201812 (unknown)
• Copy of Financial Services Sector Cybersecurity Profile MacroEnabled Assessment w User Guide and Mappings (unknown)
• Copy of Financial Services Sector Cybersecurity Profile MacroEnabled Assessment w User Guide and Mappings (unknown)
• Cybersecurity Statistics & Statements (unknown)
• DamageControl CybeInsuranceebook (unknown)
• Effective Compliance Program (unknown)
• External Service Provider and Geolocation Policy (unknown)
• ExternalProvider GeoLocation Policy (unknown)
• FBI Flash ChinaAPT10 20190102 TLPWHITE (unknown)
• FedRAMP ATO Letter Template (unknown)
• FedRAMP Initial Authorization Package Checklist (unknown)
• FedRAMP Initial Authorization Package Checklist (unknown)
• FedRAMP POAM Template (unknown)
• FedRAMP POAM Template (unknown)
• FedRAMP SAP Template (unknown)
• FedRAMP SAR Template (unknown)
• FedRAMP SSP High Baseline Template (unknown)
• HHS FaxMail PHI Checklist (unknown)
• HIPAA Overview (unknown)
• HIPAA PnP TEMPLATE AuditGuru (unknown)
• [IPD Active Directory Domain Services version 2.2](tools-templates/IPD - Active Directory Domain Services version 2.2.md) (unknown)
• Microsoft PasswordGuidance (unknown)
• NCSA SMBCyberSecurityAwarenessToolkit 20180824 (unknown)
• Office 365 Customer Security Considerations Workbook (unknown)
• Office 365 Customer Security Considerations Workbook (unknown)
• PHI 18 Identifiers (unknown)
• PedagogicCyberSecurityFramework 201810 (unknown)
• RiskRegister ControlsLibrary TEMPLATE (unknown)
• RiskRegister ControlsLibrary TEMPLATE (unknown)
• SAP AA FedRAMP High Security Test Case Procedures Template (unknown)
• SAP AA FedRAMP High Security Test Case Procedures Template (unknown)
• SAR AA FedRAMP Risk Exposure Table Template (unknown)
• SAR AA FedRAMP Risk Exposure Table Template (unknown)
• SSP A04 FedRAMP PIA Template (unknown)
• SSP A05 FedRAMP RoB Template (unknown)
• SSP A06 FedRAMP ISCP Template (unknown)
• SSP A09 FedRAMP High CIS Workbook Template (unknown)
• SSP A09 FedRAMP High CIS Workbook Template (unknown)
• SSP A12 FedRAMP Laws and Regulations Template (unknown)
• SSP A12 FedRAMP Laws and Regulations Template (unknown)
• SSP A13 FedRAMP Integrated Inventory Workbook Template (unknown)
• SSP A13 FedRAMP Integrated Inventory Workbook Template (unknown)
• STUDY UsabilityofPassphrases 20120711 (unknown)
• Switchfast SMBCybersecurityReport 20180827 (unknown)
• THE Windows GPG CLI CHEATSHEET (unknown)
• USFED WorldwideThreatAssessment 20170511 (unknown)

• [VSA Questionnaire 2019 FULL Final](tools-templates/VSA Questionnaire 2019 FULL Final.csv) (2019)
• [VSA Questionnaire 2019 FULL Final](tools-templates/VSA Questionnaire 2019 FULL Final.md) (2019)
• [VSA Questionnaire 2021 FULL Final](tools-templates/VSA Questionnaire 2021 FULL Final.csv) (2021)
• [VSA CORE FINAL 2022](frameworks/VSA CORE FINAL 2022.csv) (2022)
• [VSA CORE FINAL 2022](frameworks/VSA CORE FINAL 2022.md) (2022)
• [VSA CORE FINAL 2022](tools-templates/VSA CORE FINAL 2022.csv) (2022)
• [VSA Questionnaire](tools-templates/VSA CORE FINAL 2022.md) (2025) · source
• [VSA Questionnaire](tools-templates/VSA Questionnaire 2021 FULL Final.md) (2025) · source
• VSA Questionnaire (Vendor Security Alliance) (ongoing) · source

• Verizon DBIR 2015 (2015)
• Verizon DBIR 2016 (2016)
• Verizon DBIR 2017 (2017)
• Verizon DBIR 2018 (2018)
• Verizon DBIR 2019 (2019)
• Verizon DBIR 2019 ExecBrief (2019)
• Verizon DBIR 2020 (2020)
• Verizon DBIR 2020 ExecutiveBrief (2020)
• Verizon DBIR 2021 (2021)
• Verizon DBIR 2022 (2022)
• Verizon DBIR 2023 (2023)
• Verizon DBIR 2024 data breach investigations report (2024)
• Verizon DBIR 2024 executive summary (2024)
• Verizon DBIR 2024 infographic (2024)

• WEIS 2019 Vulnerability Management Economics Paper (2019)

• 2019 Webroot Threat Report US Online (2019)

• Wiz Security Research (ongoing) · source

• WEF Global Risks Report 2019 (2019)
• WEF The Global Risks Report 2021 (2021)
• WEF The Global Risks Report 2024 (2024)
• WEF Global Cybersecurity Outlook (Annual) (ongoing) · source

• [The One Page Linux Manual](tools-templates/The One Page Linux Manual.md) (2010)
• Minimum Viable Information Risk Management Program (2019)
• CCPA and GDPR Comparison Chart (2020)
• HIPAA Compliance Checklist (2020)
• Ransomware History and Evolution (2020)