security-controls | Information security controls frameworks are bit | iOS library

Why do you mix application security and organizational/corporate information security frameworks? Our master list strives to include all reputable information security controls, across a wide variety of domains. We support the use of labels to add metadata to controls, and if that distinction is important to your team, we encourage you to capture it within the mode. More broadly: different organizations assign security responsibilities differently, and for many firms their applications are their entire organization. There's often no meaningful distinction in the world of small business, DevSecOps, or integrated IT/security teams - the same people are responsible for most of it!. How did you choose the relationships (mappings)? We created initial mappings based on the source documents themselves (i.e., they say X maps to Y), as well as a good-faith effort to apply the relationships ("mappings") in the Simple Knowledge Organization System (SKOS), as noted above. In so many cases it's a matter of judgment and usability - if you think X should be mapped to Y, please open an issue or pull request and we can discuss it! Because relationships have metadata, you can also create and use your own without breaking anything.