Standards and Frameworks Mastery — A Cross-Cutting Module

What this is. A phase-equivalent, cross-cutting module on the security standards bodies and frameworks that every other phase relies on: OWASP, NIST, MITRE, FIRST, CIS, ISO/IEC, the IETF, and the cloud/supply-chain bodies (CSA, OpenSSF, CISA, PCI SSC) plus the cloud-provider frameworks. The phases use these constantly; this module is where you learn them from first principles and, more importantly, build the engines that operationalize them.

Why it's its own module, not a references appendix. Reading "OWASP Top 10" or "NIST 800-53" in a references list teaches nothing. A staff/principal security engineer can do four things with any framework: sort it into a kind (catalog / taxonomy / scoring / process), map it to a real system, implement and evidence a control, and crosswalk one control across many frameworks. Those are engineering skills, so this module is built like every other: a deep guide plus runnable labs with adversarial tests.

Prerequisites. Comfortable Python; ideally Phases 02, 03, 08, and 15 (the labs reuse the CVSS, crosswalk, and CWE/ATT&CK ideas those phases introduce). Everything here is offline and authorized-lab-only — the labs reason over metadata (vectors, control records, finding labels), never live systems.

Learning Objectives

By the end you can, without notes:

1. Explain each standards body — who they are, why they exist, what they publish — and sort every framework into one of the four kinds: catalog of controls, taxonomy of weaknesses/attacks, scoring system, or process/lifecycle.
2. Tie each framework to real code and infrastructure — OWASP injection to parameterized queries in Rails/Django/JDBC, NIST FIPS to OpenSSL/JVM FIPS mode, MITRE CWE to language-agnostic bug classes, IETF RFCs to your TLS/OAuth/JWT stack, CIS Benchmarks to your container/k8s/cloud config.
3. Prioritize a vulnerability backlog with CVSS × EPSS × KEV × reachability (not raw CVSS).
4. Crosswalk one engineered control across NIST/OWASP/ISO/PCI/CIS so one implementation satisfies many audits.
5. Normalize scanner findings to weakness classes (CWE) and map them to attack patterns and adversary behavior (CAPEC/ATT&CK) for coverage analysis.

The Mental Model (read the WARMUP first)

KIND                 ANSWERS                EXAMPLES                          THIS MODULE'S LAB
catalog of controls  "what should I do?"    NIST 800-53, OWASP ASVS, CIS      Lab 02 (crosswalk)
taxonomy             "what goes wrong?"     MITRE CWE/CAPEC/ATT&CK, Top 10    Lab 03 (taxonomy map)
scoring system       "how bad / how likely?" FIRST CVSS/EPSS, CISA KEV        Lab 01 (triage)
process / lifecycle  "how do I run it?"     NIST RMF/SSDF, ISO 27001, SAMM    Lab 02 (evidence/crosswalk)

See WARMUP.md for the full from-zero treatment of every body and framework, with the coding/network/cloud tie-ins and a phase-mapping table.

Labs

Each lab follows the track standard (LAB-STANDARD.md): a lab.py with focused TODOs, a complete solution.py, an adversarial test_lab.py, and a README.md. Run:

cd lab-01-vuln-triage-engine
LAB_MODULE=solution pytest -q   # reference passes
pytest -q                        # your implementation after the TODOs

Deliverables

• A working triage engine that computes correct CVSS v3.1 base scores (validated against the canonical vectors) and produces a defensible, ordered patch queue from CVSS+EPSS+KEV+reachability.
• A working crosswalk engine that validates a control library against multiple framework requirement sets, flags gaps/dangling/unsubstantiated mappings, and reports per-framework coverage and the highest-leverage controls.
• A working taxonomy mapper that deduplicates findings by CWE class, enriches them with CAPEC/ATT&CK/OWASP/Top-25 context, and reports ATT&CK detection-coverage gaps.
• The ability to answer the WARMUP's interview questions and explain, for any framework you encounter on the job, which kind it is and how you'd operationalize it.

Safety

Authorized-lab-only and entirely offline. The labs reason over metadata — CVSS vectors, control records, and finding labels in the included fixtures. No live scanning, no network, no real systems. This module is about engineering judgment over framework data, which is exactly the staff-level skill it certifies.