ASSESSMENT OF THE APPLICABILITY OF INTERNATIONAL FRAMEWORKS AND STANDARDS FOR CYBERSECURITY AS A BASIS FOR BUILDING A CLASSIFICATION MODEL IN THE “SECURITY AND DEFENCE” SECTOR
DOI:
https://doi.org/10.68302/std2026.vol1.84Keywords:
Cybersecurity, standard, framework, multidimensional modelAbstract
The report presents an analysis of leading international cybersecurity standards and frameworks to assess their applicability in building a cyber-incident response model at the political, strategic, operational and tactical levels. The emphasis is on examining the vertical and horizontal connections between the individual levels and standards, as well as on identifying the opportunities and limitations of the standards/frameworks.
Supporting Agencies
This scientific report is funded by the Ministry of Education and Science in implementation of the Scientific Program "Security and Defence", adopted by Decree No. 731 of 21.10.2021 and pursuant to Agreement No. D01-74/19.05.2022.Downloads
References
[1] The MITRE Corporation, “MITRE ATT&CK”, [Online]. Available: https://attack.mitre.org/, [Accessed: Nov. 20, 2025].
[2] The MITRE Corporation, “MITRE D3FEND Knowledge Graph”, [Online]. Available: https://d3fend.mitre.org, [Accessed: Nov. 20, 2025].
[3] ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, International Organization for Standardization, Geneva, Switzerland, 2022.
[4] National Institute of Standards and Technology, “The NIST Cybersecurity Framework (CSF) 2.0”, 2024, https://doi.org/10.6028/NIST.CSWP.29.
[5] The MITRE Corporation, “Common Attack Pattern Enumerations and Classifications”, [Online]. Available: https://capec.mitre.org/, [Accessed: Nov. 20, 2025].
[6] The Cyber Kill Chain framework, 2011, [Online]. Available: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html, [Accessed: Nov. 15, 2025].
[7] The NATO Cooperative Cyber Defence Centre of Excellence, [Online]. Available: https://ccdcoe.org/, [Accessed: Feb. 02, 2026].
[8] Directive (EU) 2022/2555 (NIS2), [Online]. Available: https://digital-strategy.ec.europa.eu/en/policies/nis2-directive, [Accessed: Dec. 27, 2025].
[9] The European Union Agency for Cybersecurity, [Online]. Available: https://www.enisa.europa.eu/, [Accessed: Jan. 05, 2026].
[10] ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection — Information security controls, International Organization for Standardization, Geneva, Switzerland, 2022.
[11] National Institute of Standards and Technology, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile, 2025, https://doi.org/10.6028/NIST.SP.800-61r3.
[12] I.F.Z. Poetiray, M. Salman, “Information security incident management using ISO 27035 standard”, Gema Wiralodra, 2023, https://doi.org/10.31943/gw.v14i3.487.
[13] VERIS, “The Vocabulary for Event Recording and Incident Sharing”, [Online]. Available: https://verisframework.org/, [Accessed: Feb. 15, 2026].
[14] S. Caltagirone, A. Pendergast, C. Betz, “Diamond Model of Intrusion Analysis,” Center for Cyber Threat Intelligence and Threat Research, Hanover, MD, 2013, [Online]. Available: https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf, [Accessed: Jan. 10, 2026].
[15] National Institute of Standards and Technology, “National Vulnerability Database”, 1999, [Online]. Available: https://nvd.nist.gov/, [Accessed: Nov. 15, 2025].
[16] Forum of Incident Response and Security Teams, [Online]. Available: https://www.first.org/, [Accessed: Dec. 16, 2026].
[17] The MITRE Corporation, [Online]. Available: https://www.mitre.org/, [Accessed: Nov. 22, 2025].
[18] OASIS Committee Specification, STIX v. 2.1, January 2021, [Online]. Available: https://docs.oasis-open.org/cti/stix/v2.1/cs02/ stix-v2.1-cs02.pdf, [Accessed: Mar. 25, 2026].
[19] OASIS Standard TAXII v2.1, June 2021, [Online]. Available: https://docs.oasis-open.org/cti/taxii/v2.1/os/taxii-v2.1-os.pdf, [Accessed: Mar. 25, 2026].
[20] R. K. Yin, “Case Study Research and Applications”, 6th ed., SAGE Publications Inc, 2018, USA, ISBN 9781506336169.
[21] D. J. Landoll, “Security Risk Assessment Handbook: A Complete Guide for Performing Security Risk Assessments”, 3rd ed., CRC Press, 2021, https://doi.org/10.1201/9781003090441.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Atanas Nikolov
This work is licensed under a Creative Commons Attribution 4.0 International License.
