{
  "$schema_version": "1.0",
  "projection": "slim",
  "full_catalog": "https://aisharedresponsibility.com/data/security-principles.json",
  "description": "Slim projection of security-principles.json for assessment mapping: id, statement, category, and related. Fetch the full catalog for src citations and the framework table.",
  "updated": "2026-09-01",
  "count": 87,
  "principles": [
    {
      "id": "least-privilege",
      "statement": "Grant only the minimum access needed to perform a task, nothing more.",
      "category": "access-control",
      "related": [
        "cis18-6"
      ]
    },
    {
      "id": "sch-2",
      "statement": "Deny by default when a decision is ambiguous or a control fails.",
      "category": "access-control"
    },
    {
      "id": "sch-3",
      "statement": "Check every access to every object, every time.",
      "category": "access-control",
      "related": [
        "nist-p32"
      ]
    },
    {
      "id": "sch-6",
      "statement": "Require more than one condition or party to authorize sensitive actions.",
      "category": "access-control"
    },
    {
      "id": "iso-availability",
      "statement": "Data and systems are accessible to authorized users when needed.",
      "category": "cia-triad"
    },
    {
      "id": "iso-confidentiality",
      "statement": "Information is accessible only to those authorized to have access.",
      "category": "cia-triad"
    },
    {
      "id": "iso-integrity",
      "statement": "Data is accurate, complete, and protected from unauthorized alteration.",
      "category": "cia-triad"
    },
    {
      "id": "cis18-1",
      "statement": "Inventory and Control of Enterprise Assets",
      "category": "control-category"
    },
    {
      "id": "cis18-10",
      "statement": "Malware Defenses",
      "category": "control-category"
    },
    {
      "id": "cis18-11",
      "statement": "Data Recovery",
      "category": "control-category"
    },
    {
      "id": "cis18-12",
      "statement": "Network Infrastructure Management",
      "category": "control-category"
    },
    {
      "id": "cis18-13",
      "statement": "Network Monitoring and Defense",
      "category": "control-category",
      "related": [
        "corollary-3",
        "ms-risk-7"
      ]
    },
    {
      "id": "cis18-14",
      "statement": "Security Awareness and Skills Training",
      "category": "control-category"
    },
    {
      "id": "cis18-15",
      "statement": "Service Provider Management",
      "category": "control-category",
      "related": [
        "corollary-1"
      ]
    },
    {
      "id": "cis18-16",
      "statement": "Application Software Security",
      "category": "control-category",
      "related": [
        "corollary-1"
      ]
    },
    {
      "id": "cis18-17",
      "statement": "Incident Response Management",
      "category": "control-category"
    },
    {
      "id": "cis18-18",
      "statement": "Penetration Testing",
      "category": "control-category"
    },
    {
      "id": "cis18-2",
      "statement": "Inventory and Control of Software Assets",
      "category": "control-category"
    },
    {
      "id": "cis18-3",
      "statement": "Data Protection",
      "category": "control-category"
    },
    {
      "id": "cis18-4",
      "statement": "Secure Configuration of Enterprise Assets and Software",
      "category": "control-category"
    },
    {
      "id": "cis18-5",
      "statement": "Account Management",
      "category": "control-category"
    },
    {
      "id": "cis18-6",
      "statement": "Access Control Management",
      "category": "control-category",
      "related": [
        "least-privilege"
      ]
    },
    {
      "id": "cis18-7",
      "statement": "Continuous Vulnerability Management",
      "category": "control-category"
    },
    {
      "id": "cis18-8",
      "statement": "Audit Log Management",
      "category": "control-category"
    },
    {
      "id": "cis18-9",
      "statement": "Email and Web Browser Protections",
      "category": "control-category"
    },
    {
      "id": "encryption-is-not-sufficient",
      "statement": "Encryption is only as strong as its key management; encryption alone does not constitute a data protection program.",
      "category": "data-protection",
      "related": [
        "nist-p9"
      ]
    },
    {
      "id": "nist-p9",
      "statement": "Protect information while being processed, in transit, and in storage",
      "category": "data-protection",
      "related": [
        "encryption-is-not-sufficient"
      ]
    },
    {
      "id": "economy-of-mechanism",
      "statement": "Keep designs small and simple enough to verify and reason about.",
      "category": "design"
    },
    {
      "id": "nist-p12",
      "statement": "Where possible, base security on open standards for portability and interoperability",
      "category": "design",
      "related": [
        "sch-5"
      ]
    },
    {
      "id": "nist-p14",
      "statement": "Design security to allow for regular adoption of new technology, including a secure and logical upgrade process",
      "category": "design"
    },
    {
      "id": "nist-p2",
      "statement": "Treat security as an integral part of the overall system design",
      "category": "design"
    },
    {
      "id": "nist-p25",
      "statement": "Minimize the system elements to be trusted",
      "category": "design",
      "related": [
        "sch-7"
      ]
    },
    {
      "id": "nist-p27",
      "statement": "Do not implement unnecessary security mechanisms",
      "category": "design"
    },
    {
      "id": "nist-p3",
      "statement": "Clearly delineate the physical and logical security boundaries governed by associated security policies",
      "category": "design"
    },
    {
      "id": "nist-p31",
      "statement": "Formulate security measures to address multiple overlapping information domains",
      "category": "design"
    },
    {
      "id": "sch-5",
      "statement": "Security should not depend on secrecy of the design (Kerckhoffs's principle).",
      "category": "design",
      "related": [
        "nist-p12"
      ]
    },
    {
      "id": "sch-7",
      "statement": "Minimize shared state between users or components.",
      "category": "design",
      "related": [
        "nist-p25"
      ]
    },
    {
      "id": "ms-immutable-1",
      "statement": "If a bad actor can persuade you to run their program on your computer, it's not solely your computer anymore.",
      "category": "endpoint-security"
    },
    {
      "id": "ms-immutable-2",
      "statement": "If a bad actor can alter the operating system on your computer, it's not your computer anymore.",
      "category": "endpoint-security"
    },
    {
      "id": "ms-immutable-8",
      "statement": "An out-of-date antimalware scanner is only marginally better than no scanner at all.",
      "category": "endpoint-security"
    },
    {
      "id": "cis-design-3",
      "statement": "Every safeguard must be specific and practical to implement.",
      "category": "governance"
    },
    {
      "id": "cis-design-4",
      "statement": "Every control, especially in Implementation Group 1, must have unambiguous, checkable criteria.",
      "category": "governance"
    },
    {
      "id": "cis-design-5",
      "statement": "Coexist with other frameworks (NIST, CSA, MITRE ATT&CK, OWASP) rather than compete with them.",
      "category": "governance"
    },
    {
      "id": "iso-annex-a",
      "statement": "93 controls organized into four themes: organizational, people, physical, and technological.",
      "category": "governance"
    },
    {
      "id": "iso-clauses",
      "statement": "Context, leadership, planning, support, operation, performance evaluation, and improvement requirements for the ISMS.",
      "category": "governance"
    },
    {
      "id": "ms-risk-6",
      "statement": "Cybersecurity is a team sport.",
      "category": "governance"
    },
    {
      "id": "nist-p1",
      "statement": "Establish a sound security policy as the foundation for design",
      "category": "governance"
    },
    {
      "id": "nist-p13",
      "statement": "Use common language in developing security requirements",
      "category": "governance"
    },
    {
      "id": "nist-p4",
      "statement": "Ensure that developers are trained in how to develop secure software",
      "category": "human-factors"
    },
    {
      "id": "psychological-acceptability",
      "statement": "Security controls that are too painful or that hurt productivity get bypassed by real users, so ease of use is a security requirement, not a nice-to-have.",
      "category": "human-factors"
    },
    {
      "id": "technology-is-not-a-panacea",
      "statement": "Technology does not solve people and process problems; it is not a substitute for governance, training, and operational discipline.",
      "category": "human-factors"
    },
    {
      "id": "corollary-2",
      "statement": "If the identity system is compromised, the entire cloud infrastructure is compromised.",
      "category": "identity",
      "related": [
        "ms-immutable-6",
        "nist-p33"
      ]
    },
    {
      "id": "corollary-4",
      "statement": "Any centralized administrative pathway is a primary target for attackers.",
      "category": "identity",
      "related": [
        "ms-immutable-6"
      ]
    },
    {
      "id": "ms-immutable-5",
      "statement": "Weak passwords trump strong security.",
      "category": "identity"
    },
    {
      "id": "ms-immutable-6",
      "statement": "A computer is only as secure as the administrator is trustworthy.",
      "category": "identity",
      "related": [
        "corollary-2",
        "corollary-4",
        "nist-p33"
      ]
    },
    {
      "id": "nist-p32",
      "statement": "Authenticate users and processes to ensure appropriate access control decisions both within and across domains",
      "category": "identity",
      "related": [
        "sch-3"
      ]
    },
    {
      "id": "nist-p33",
      "statement": "Use unique identities to ensure accountability",
      "category": "identity",
      "related": [
        "corollary-2",
        "ms-immutable-6"
      ]
    },
    {
      "id": "nist-p28",
      "statement": "Ensure proper security in the shutdown or disposal of a system",
      "category": "lifecycle"
    },
    {
      "id": "nist-p22",
      "statement": "Design and implement audit mechanisms to detect unauthorized use and support incident investigations",
      "category": "monitoring"
    },
    {
      "id": "ms-immutable-3",
      "statement": "If a bad actor has unrestricted physical access to your computer, it's not your computer anymore.",
      "category": "physical-security"
    },
    {
      "id": "ms-immutable-9",
      "statement": "Absolute anonymity isn't practically achievable, either online or offline.",
      "category": "privacy"
    },
    {
      "id": "ms-risk-8",
      "statement": "Isolated networks aren't automatically secure.",
      "category": "resilience"
    },
    {
      "id": "nist-p16",
      "statement": "Implement layered security, ensure no single point of vulnerability",
      "category": "resilience"
    },
    {
      "id": "nist-p17",
      "statement": "Design and operate an IT system to limit damage and be resilient in response",
      "category": "resilience"
    },
    {
      "id": "nist-p18",
      "statement": "Provide assurance that the system is, and continues to be, resilient in the face of expected threats",
      "category": "resilience"
    },
    {
      "id": "nist-p19",
      "statement": "Limit or contain vulnerabilities",
      "category": "resilience"
    },
    {
      "id": "nist-p20",
      "statement": "Isolate public access systems from mission-critical resources (data, processes, etc.)",
      "category": "resilience"
    },
    {
      "id": "nist-p21",
      "statement": "Use boundary mechanisms to separate computing systems and network infrastructures",
      "category": "resilience"
    },
    {
      "id": "nist-p23",
      "statement": "Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability",
      "category": "resilience"
    },
    {
      "id": "nist-p30",
      "statement": "Implement security through a combination of measures distributed physically and logically",
      "category": "resilience"
    },
    {
      "id": "cis-design-1",
      "statement": "Controls are selected, dropped, and prioritized based on real attacker behavior and how to stop it.",
      "category": "risk-management"
    },
    {
      "id": "cis-design-2",
      "statement": "Identify the most critical actions to stop the most important attacks; avoid trying to solve every problem.",
      "category": "risk-management"
    },
    {
      "id": "ms-risk-1",
      "statement": "Security success is ruining the attacker's ROI.",
      "category": "risk-management"
    },
    {
      "id": "ms-risk-2",
      "statement": "Not keeping up is falling behind.",
      "category": "risk-management"
    },
    {
      "id": "ms-risk-4",
      "statement": "Attackers don't care.",
      "category": "risk-management",
      "related": [
        "nist-p6"
      ]
    },
    {
      "id": "ms-risk-5",
      "statement": "Ruthless prioritization is a survival skill.",
      "category": "risk-management"
    },
    {
      "id": "nist-p10",
      "statement": "Consider custom products to achieve adequate security",
      "category": "risk-management"
    },
    {
      "id": "nist-p11",
      "statement": "Protect against all likely classes of attacks",
      "category": "risk-management"
    },
    {
      "id": "nist-p29",
      "statement": "Identify and prevent common errors and vulnerabilities",
      "category": "risk-management"
    },
    {
      "id": "nist-p5",
      "statement": "Reduce risk to an acceptable level",
      "category": "risk-management"
    },
    {
      "id": "nist-p6",
      "statement": "Assume that external systems are insecure",
      "category": "risk-management",
      "related": [
        "ms-risk-4"
      ]
    },
    {
      "id": "nist-p7",
      "statement": "Identify potential trade-offs between reducing risk and increased costs or decreased operational effectiveness",
      "category": "risk-management"
    },
    {
      "id": "nist-p8",
      "statement": "Implement tailored system security measures to meet organizational security goals",
      "category": "risk-management"
    },
    {
      "id": "corollary-1",
      "statement": "Security is only as strong as the weakest link, including the third-party supply chain.",
      "category": "supply-chain",
      "related": [
        "cis18-15",
        "cis18-16"
      ]
    },
    {
      "id": "ms-immutable-4",
      "statement": "If you allow a bad actor to run active content on your website, it's not your website anymore.",
      "category": "web-security"
    },
    {
      "id": "corollary-3",
      "statement": "Continuous monitoring and response will always beat static perimeter defense.",
      "category": "zero-trust",
      "related": [
        "cis18-13",
        "ms-risk-7"
      ]
    },
    {
      "id": "ms-risk-7",
      "statement": "Your network isn't as trustworthy as you think it is.",
      "category": "zero-trust",
      "related": [
        "cis18-13",
        "corollary-3"
      ]
    }
  ]
}