Here is a comprehensive list of the standards, frameworks, and architectures mentioned in

the sources, along with their purposes and citations:

 NIST Cybersecurity Framework: Formally titled the NIST Framework for Improving
Critical Infrastructure Cybersecurity. It provides high-level guidance for aligning an
organisation's cybersecurity program with enterprise objectives. The framework helps
organisations understand, assess, and improve their ability to prevent, detect, and
respond to cyber attacks. It highlights the need for effective risk management
integration and broadly supports improvement in supply chain risk management. It is
also mentioned as a resource for developing a security program and is used as a
basis for the NIST Risk Assessment Methodology.

 ISO/IEC 27000 Series: This is a family of standards and provides a useful

framework to gauge the comprehensiveness of an organisation's security strategy
and to align all relevant elements of security across the organisation. The ISO/IEC
27001:2013 standard is specifically mentioned in this context. The sources also refer
to ISO/IEC 27014:2013 Information technology—Security techniques—Governance of
information security, ISO/IEC 27002:2013 Information technology—Security
techniques—Code of practice for information security controls, and the broader
ISO/IEC 27000 family as standards that can be used to create organisational policies
and standards directly related to each element of the standard. It is also mentioned
that compliance with ISO/IEC 27001:2013 can be certified.

 COBIT (Control Objectives for Information and related Technology): This is a

comprehensive framework for the governance and management of enterprise IT.
COBIT addresses IT security, governance, risk, and information security in general. It
is based on two sets of principles: principles that describe the core requirements of a
governance system for enterprise information and technology, and principles for a
governance framework that can be used to build such a system. COBIT is also
mentioned in the context of performing a risk assessment, followed by analysis, and
its COBIT 5 for Risk is mentioned as a source for a figure illustrating risk scenario
approaches and risk assessment process.

 TOGAF (The Open Group Architecture Framework): This is an enterprise

architecture framework. It provides a structured approach for developing an
enterprise architecture. TOGAF addresses four interrelated domains of specialisation:
Business, Data, Application, and Technology. Figure 3.10 illustrates the TOGAF
Architecture Development Method.

 SABSA (Sherwood Applied Business Security Architecture): This is described

as an enterprise security architecture framework. Figure 2.3 presents operational risk
categories derived from SABSA.

 Zachman Framework: This is another enterprise architecture framework. It is

presented as a classification scheme for artifacts used in enterprise architecture.

 ITIL (Information Technology Infrastructure Library): Mentioned as one of the

other approaches and methods that may be useful. ITIL provides a set of best-
practice guidance for IT service management.
  CMMI (Capability Maturity Model Integration): Suggested as a model that can
be combined with COBIT and balanced scorecards. ISACA's CMMI v2.0 is also listed as
a resource. It provides a framework for process improvement across an organisation.

 FAIR (Factor Analysis of Information Risk): This is a recognised industry

standard for decomposing risk and understanding its components. It offers a
reasoned and logical framework for analysing information risk. Figure 2.14 illustrates
the FAIR methodology.

 Balanced Scorecard: This is a strategic planning and management system used by

organisations to communicate and align around strategy, prioritise, and measure
performance. It provides a framework for measuring organisational performance
against strategic goals across four perspectives: financial, customer, internal
processes, and learning and growth. It is also mentioned as something that can be
combined with COBIT and CMMI.

 NIST Risk Assessment Methodology: This methodology is based on the NIST

Cybersecurity Framework.

 NIST Special Publication 800-30: This publication, titled "Guide for Conducting
Risk Assessments", describes the roles for personnel who must support and
participate in the risk management process. It is also referenced as NIST Special
Publication 800-30 Revision 1, providing a guide for conducting risk assessments and
a list of vulnerabilities to consider. Figure 2.12 illustrates the NIST Risk Assessment
Methodology, which appears to be based on NIST SP 800-30.

 NIST Special Publication 800-37 Revision 2: This publication points out that the
risk management strategy makes explicit the threats, assumptions, constraints,
priorities, trade-offs, and risk tolerance used for making investment and operational
decisions. This strategy includes the strategic-level decisions for how senior leaders
and executive leadership intend to manage security and privacy risks.

 ISO 31000: Mentioned as the International Organization for Standardization (ISO)

standard for Risk Management—Guidelines.

 ISACA's Risk IT Framework: Listed as a resource for further reading on information

risk management. ISACA's The Risk IT Framework 2nd Edition is also mentioned as a
resource.

 ISACA, COBIT 2019 Design Guide: Designing an Information and Technology

Governance Solution: Listed as a resource.

 ISACA, COBIT 2019 Implementation Guide: Implementing and Optimizing an

Information and Technology Governance Solution: Listed as a resource. Figure
1.4, illustrating an example RACI chart, is sourced from this guide.

These sources also discuss concepts related to risk management throughout Chapters 2
and 3, including risk identification, risk assessment, risk response, risk monitoring, and risk
reporting. Various methodologies and approaches for risk assessment are mentioned, such
as qualitative and quantitative analysis, scenario analysis, and the use of frameworks like
FAIR and COBIT.
Incident Management is the focus of Chapter 4, which details processes for incident
readiness, incident identification and response, and post-incident activities. While no specific
standard or framework is exclusively dedicated to incident management and explicitly
named as such within the chapter outline provided, the chapter itself likely draws upon best
practices and potentially aligns with elements of broader frameworks like NIST and ISO.

Mention Nist :

Here are all the lines or portions containing the word "NIST" in the provided sources:

 " formally titled the NIST Framework for Improving Critical Infrastructure
Cybersecurity"

 "1.6.4 Information Governance Frameworks and Standards"

 "NIST Cybersecurity Framework"

 "COBIT 5, ITAF, NIST 800-30, ISO/IEC 27005:2018, ISO/IEC 31000, ITIL, and
CRAMM."

 "The NIST risk assessment methodology encompasses the nine primary steps:"

 "Figure 2.12–NIST Risk Assessment Methodology"

 "Source: National Institute of Standards and Technology, Special Publication 800-30,

Revision 1: Guide for Conducting Risk Assessments, USA, 2012. Reprinted courtesy of
the NIST, US Department of Commerce. Not copyrightable in the United States of
America."

 "NIST Risk Assessment Methodology"

 "The NIST Special Publication 800-30 Revision 1: Guide to Conducting Risk

Assessments provides a list of vulnerabilities to consider, along with predisposing
conditions that may lead to the rapid or unpredictable emergence of new
vulnerabilities"

 "NIST Special Publication 800-30-Revision 1"

 "National Institute of Standards and Technology (NIST) Special Publication 800-39

Managing Information Security Risk: Organization, Mission, and Information System
View, USA, 2011"

 "NIST Special Publication 800-39 Managing Information Security Risk: Organization,

Mission, and Information System View"

 "Figure 2.12—NIST Risk Assessment Methodology"

 "The NIST Risk Management Framework (RMF)"

 "The NIST Cybersecurity Framework does not provide controls to be applied."

 "Formally titled the NIST Framework for Improving Critical Infrastructure

Cybersecurity, the NIST Cybersecurity Framework provides high-level guidance for
aligning an organisation's cybersecurity program with enterprise objectives."
 "The framework highlights the need for effective risk management integration and it
broadly supports improvement in supply chain risk management."

 "The NIST Risk Management Framework (RMF) provides a process that integrates
security, privacy and cyber supply chain risk management activities into the system
development life cycle."

 "Other approaches and methods that may be useful include other ISO standards on
quality management, business publications from NIST, the Six Sigma approach to
quality and business management"

 "NIST Special Publication 800-37 Revision 2 points out"

 "NIST Special Publication 800-37 Revision 2"

 "NIST Special Publication 800-37 Revision 2, Applying the Risk Management

Framework to Federal Information Systems: A Security Life Cycle Approach"

 "NIST Special Publication 800-30 Revision 1"

 "NIST Special Publication 800-30, Guide for Conducting Risk Assessments, 2012"

 "COBIT, NIST Special Publication 800-39 Managing Information Security Risk:

Organization, Mission and Information System View"

 "NIST Cybersecurity Framework"

 "Formally titled the NIST Framework for Improving Critical Infrastructure

Cybersecurity, this model provides high-level guidance for aligning a cybersecurity
program with enterprise objectives."

 "In response to an increasing prevalence of cybersecurity attacks, NIST convened a

series of workshops to develop a process by which an enterprise could identify
opportunities for improvement in the security program."

 "The framework highlights the need for effective risk management integration and it
broadly supports improvement in supply chain risk management."

 "The NIST Cybersecurity Framework does not prescribe the process of determining
gaps between the current state of practice and a desired target state that might
better fulfil enterprise mission, including risk management needs."

 "Analysis of the gaps between states enables the use of controls-based frameworks
(including those listed herein) to improve information security risk management."

 "The NIST Risk Management Framework (RMF)"

 "The RMF provides a process that integrates security, privacy, and cyber supply chain
risk management activities into the system development life cycle."

 "To help US government agencies to evaluate and improve information security, it

has been broadened to apply to any enterprise and is available without cost."
 "The RMF provides a risk-based approach to the selection and implementation of
security controls to achieve adequate protection, and provisions for monitoring the
continued effectiveness and efficiency of risk management measures."

 "Prepare for applying the framework by determining enterprise goals and objectives,
relevant risk management directives, enterprise risk strategy and policy directives,
organisational roles regarding risk management (existing and planned) and methods
for monitoring and communicating risk activities."

 "Categorise the system and information processed, stored and transmitted based on
an analysis of the impact of the loss of security or privacy."

 "Select security and privacy controls by reviewing (generally published in NIST

Special Publication 800-53) that will achieve the appropriate risk management
objectives in light of the categorisation."

 "Baseline sets of controls are provided in a separate document as a starting point,

and they can then be tailored to achieve risk management objectives."

 "Similar processes are available for shared controls throughout the enterprise."

 "Implement the controls as described in a detailed system security plan and update
relevant documentation, as needed."

 "Assess the efficacy of the implemented controls by using disciplined criteria

(typically the disciplined criteria described in NIST Special Publication 800-53)."

 "This document recommends methods for examining evidence, interviewing

stakeholders, and testing actual operation of implemented controls."

 "Authorise the system for operation, based on a determination from a senior official
that the steps above have been completed and that the risk to the enterprise falls
under the potential impact of a loss as determined in Step 2."

 "If the risk is not found to be acceptable, or the system owner may be directed to
correct deficiencies."

 "Monitor the system (or common control infrastructure) through ongoing assessment
of the implemented controls, including providing appropriate updates of the
documentation, of major changes to the system or the risk landscape that might
trigger a second or changes to the security plan."

 "The US National Institute of Standards and Technology (NIST) defines APT as"

 "Source: NIST, "2021 Data Breach Investigations Report,"

[Link]/business/resources/reports/dbir/"

 "National Institute of Standards and Technology (NIST) as follows:"

 "NIST Cybersecurity Framework"

 "The NIST Cybersecurity Framework provides a high-level guidance for aligning an

organisation's cybersecurity program with enterprise objectives"
 "The NIST Cybersecurity Framework highlights the need for effective risk
management integration and it broadly supports improvement in supply chain risk
management"

 "Other approaches and methods that may be useful include other ISO standards on
quality management, business publications from NIST"

 "NIST Special Publication 800-37 Revision 2 points out"

 "Details regarding threat, vulnerability and risk exposure are described in Chapter 2,
but these high-level factors must be included in strategic planning."

 "NIST Special Publication 800-37 Revision 2 points out:"

 "The risk management strategy makes explicit the threats, assumptions, constraints,
priorities, trade-offs, and risk tolerance used for making investment and operational
decisions."

 "This strategy includes the strategic-level decisions for how senior leaders and
executive leadership intend to manage security and privacy risks."

 "Informed by the information security management strategy should include a

comprehensive plan for identifying, assessing and incorporating security risks."

 "Strategic planning."

 "The US National Institute for Standards and Technology (NIST)"

 "PriceWaterhouse Coopers, The Global State of Information Security Survey 2017,

[Link]/gx/en/consulting-services/information-security-survey"

 "National Institute of Standards and Technology (NIST), Integrating Cybersecurity

and Enterprise Risk Management (ERM), USA, 2020,
[Link]

 "NIST Special Publication 800-30 Revision 1"

 "The NIST Special Publication 800-30 Revision 1: Guide to Conducting Risk

Assessments provides a list of vulnerabilities to consider, along with predisposing
conditions that may lead to the rapid or unpredictable emergence of new
vulnerabilities"

 "Note: Other sources of vulnerabilities include:"

 "National Vulnerability Database at [Link]"

 "NIST Special Publication 800-39"

 "Assess the efficacy of the implemented controls by using disciplined criteria

(typically the disciplined criteria described in NIST Special Publication 800-53)."

 "The NIST risk assessment methodology"

 "The NIST risk assessment methodology encompasses the nine primary steps:"

 "Step 1—System (or general domain) characterisation"

 "Step 2—Threat identification"

 "Step 3—Vulnerability identification"

 "Step 4—Control analysis"

 "Step 5—Likelihood determination"

 "Step 6—Impact analysis"

 "Step 7—Risk determination"

 "Step 8—Control recommendations"

 "Step 9—Results documentation"

 "Figure 2.12 illustrates these steps and the inputs to and outputs from each step."

 "Source: National Institute of Standards and Technology, Special Publication 800-30,

Revision 1: Guide for Conducting Risk Assessments, USA, 2012. Reprinted courtesy of
the NIST, US Department of Commerce. Not copyrightable in the United States of
America."

 "The NIST Risk Management Framework (RMF) "

 "The RMF provides a process that integrates security, privacy, and cyber supply chain
risk management activities into the system development life cycle "

 "To help US government agencies to evaluate and improve information security, it

has been broadened to apply to any enterprise and is available without cost "

 "The RMF provides a risk-based approach to the selection and implementation of

security controls to achieve adequate protection, and provisions for monitoring the
continued effectiveness and efficiency of risk management measures "

 "Prepare for applying the framework by determining enterprise goals and objectives,
relevant risk management directives, enterprise risk strategy and policy directives,
organisational roles regarding risk management (existing and planned), and methods
for monitoring and communicating risk activities "

 "Categorise the system and information processed, stored and transmitted based on
an analysis of the impact of the loss of security or privacy "

 "Select security and privacy controls by reviewing (generally published in NIST

Special Publication 800-53) that will achieve the appropriate risk management
objectives in light of the categorisation "

 "Baseline sets of controls are provided in a separate document as a starting point,

and they can then be tailored to achieve risk management objectives "

 "Similar processes are available for shared controls throughout the enterprise "

 "Implement the controls as described in a detailed system security plan and update
relevant documentation as needed "
 "Assess the efficacy of the implemented controls by using disciplined criteria
(typically the disciplined criteria described in NIST Special Publication 800-53) "

 "This document recommends methods for examining evidence, interviewing

stakeholders, and testing actual operation of implemented controls "

 "Authorise the system for operation, based on a determination from a senior official
that the steps above have been completed and that the risk to the enterprise falls
under the potential impact of a loss as determined in Step 2 "

 "If the risk is not found to be acceptable, or the system owner may be directed to
correct deficiencies "

 "Monitor the system (or common control infrastructure) through ongoing assessment
of the implemented controls, including providing appropriate updates of the
documentation, of major changes to the system or the risk landscape that might
trigger a second or changes to the security plan "

 "The US National Institute of Standards and Technology (NIST) defines APT as:"

 "Source: NIST, "2021 Data Breach Investigations Report,"

[Link]/business/resources/reports/dbir/ "

 "National Institute of Standards and Technology (NIST) as follows:"

 "Formally titled the NIST Framework for Improving Critical Infrastructure

Cybersecurity, this model provides high-level guidance for aligning a cybersecurity
program with enterprise objectives"

 "In response to an increasing prevalence of cybersecurity attacks, NIST convened a

series of workshops to develop a process by which an enterprise could identify
opportunities for improvement in the security program"

 "The framework highlights the need for effective risk management integration and it
broadly supports improvement in supply chain risk management"

 "The NIST Cybersecurity Framework does not prescribe the process of determining
gaps between the current state of practice and a desired target state that might
better fulfil enterprise mission, including risk management needs"

 "Analysis of the gaps between states enables the use of controls-based frameworks
(including those listed herein) to improve information security risk management"

 "The NIST Risk Management Framework (RMF)"

 "The RMF provides a process that integrates security, privacy, and cyber supply chain
risk management activities into the system development life cycle"

 "To help US government agencies to evaluate and improve information security, it

has been broadened to apply to any enterprise and is available without cost"

 "The RMF provides a risk-based approach to the selection and implementation of

security controls to achieve adequate protection, and provisions for monitoring the
continued effectiveness and efficiency of risk management measures"
 "Prepare for applying the framework by determining enterprise goals and objectives,
relevant risk management directives, enterprise risk strategy and policy directives,
organisational roles regarding risk management (existing and planned), and methods
for monitoring and communicating risk activities"

 "Categorise the system and information processed, stored and transmitted based on
an analysis of the impact of the loss of security or privacy"

 "Select security and privacy controls by reviewing (generally published in NIST

Special Publication 800-53) that will achieve the appropriate risk management
objectives in light of the categorisation"

 "Baseline sets of controls are provided in a separate document as a starting point,

and they can then be tailored to achieve risk management objectives"

 "Similar processes are available for shared controls throughout the enterprise"

 "Implement the controls as described in a detailed system security plan and update
relevant documentation as needed"

 "Assess the efficacy of the implemented controls by using disciplined criteria

(typically the disciplined criteria described in NIST Special Publication 800-53)"

 "This document recommends methods for examining evidence, interviewing

stakeholders, and testing actual operation of implemented controls"

 "Authorise the system for operation, based on a determination from a senior official
that the steps above have been completed and that the risk to the enterprise falls
under the potential impact of a loss as determined in Step 2"

 "If the risk is not found to be acceptable, or the system owner may be directed to
correct deficiencies"

 "Monitor the system (or common control infrastructure) through ongoing assessment
of the implemented controls, including providing appropriate updates of the
documentation, of major changes to the system or the risk landscape that might
trigger a second or changes to the security plan"

 "The US National Institute of Standards and Technology (NIST) defines APT as:"

 "Source: NIST, "2021 Data Breach Investigations Report,"

[Link]/business/resources/reports/dbir/ "

 "National Institute of Standards and Technology (NIST) as follows:"