244 results
ISO/IEC 27036 (Cybersecurity — Supplier relationships), explained
What ISO/IEC 27036's four parts actually require: Part 2's certifiable requirements vs. Parts 1/3/4 guidance, the 2021-2023 revision wave, and how it ties to firmware SBOMs and NIST SP 800-161.
6 min read Updated
ISO/IEC 27402 (IoT device baseline requirements), explained
ISO/IEC 27402:2023 — the 'horizontal' baseline ICT requirements for IoT devices, its two requirement clauses (policies/documentation and capabilities/operations), its place in the ISO/IEC 27400 family, and how it compares to ETSI EN 303 645 and NIST IR 8259A.
5 min read Updated
ISO/IEC 42001:2023: the AI management system (AIMS) standard, explained
What ISO/IEC 42001:2023 actually requires: its Harmonized Structure clauses 4-10, the 38 Annex A controls across nine objectives, AI system impact assessment, how certification works, and where it fits next to the EU AI Act and NIST AI RMF.
5 min read Updated
ISO/SAE 21434 (road vehicles — cybersecurity engineering), explained
ISO/SAE 21434:2021's 15-clause structure, the TARA (threat analysis and risk assessment) process, Cybersecurity Assurance Levels (CAL), and how it relates to UN R155's CSMS mandate.
5 min read Updated
JC-STAR (Japan IoT security labeling), explained
What JC-STAR actually requires: IPA's four STAR-1 to STAR-4 conformance levels, the METI policy behind it, self-declaration vs third-party assessment, and its 2026 mutual recognition with Singapore's CLS and the UK's PSTI.
4 min read Updated
KEV and EPSS: a practical way to prioritise vulnerabilities in OT and device fleets
How to combine CISA's KEV catalog and FIRST's EPSS score to triage vulnerabilities in OT and device fleets, with CISA's BOD 26-04 deadlines and SSVC.
4 min read Updated
KNX protocol security: what KNX Secure fixes, and why classic KNX cannot be patched
The classic KNX bus that runs most commercial building automation carries no authentication or encryption — and ABB's own 2026 CISA advisory says that gap 'cannot be resolved with a software update on a technical level.' What KNX Data Secure and KNX IP Secure actually add, and what two documented ETS and BCU-key vulnerabilities show about where real KNX deployments fail.
6 min read Updated
LoRaWAN security: what the protocol actually protects in industrial sensor networks
LoRaWAN secures the join process and application/network session traffic with AES-128 and a frame-counter replay check — but the LoRa Alliance's own spec leaves key provisioning out of scope, and ABP activation quietly drops the protections OTAA provides. What device makers and buyers need to verify before trusting a LoRaWAN sensor deployment.
7 min read Updated
Machinery Regulation cybersecurity: what 2023/1230 means for machine builders
Cybersecurity in the EU Machinery Regulation 2023/1230: Annex III 1.1.9 and 1.2.1, the 20 January 2027 date, the link with the CRA, and next steps.
5 min read Updated
Manufacturer Usage Description (MUD, RFC 8520), explained
IETF RFC 8520, the Manufacturer Usage Description Specification (March 2019) — how a MUD URL is emitted via DHCP/LLDP/802.1AR certificates, what a MUD file and MUD manager do, and what it means for IoT device and firmware makers.
4 min read Updated
Matter protocol security: what certification actually covers for connected devices
Matter builds PKI-based authentication and encryption into its spec, and the Connectivity Standards Alliance's Product Security program now certifies whole IoT systems, not just devices. What Product Security 1.1 actually requires, and why Matter certification is not the same claim as CRA, PSTI or Cyber Trust Mark compliance.
5 min read Updated
MCP server security: the core risks, explained
Model Context Protocol (MCP) security — what MCP is, how hosts, clients and servers fit together, and the core attack classes (confused deputy, token passthrough, SSRF, local-server compromise) per the protocol's own security guidance.
5 min read Updated
MDCG 2019-16: the EU's guidance on cybersecurity for medical devices
MDCG 2019-16 Rev.1 (July 2020): how the EU's Medical Device Coordination Group maps MDR/IVDR Annex I cybersecurity essential requirements to pre-market design, documentation and post-market vigilance duties.
5 min read Updated
MDS2 explained: what the Manufacturer Disclosure Statement for Medical Device Security actually covers
MDS2 (ANSI/NEMA HN 1-2019) is the standardized form hospitals use to ask medical device makers 23 questions about security controls, from authentication to SBOM. What it covers, what FDA says it does and doesn't prove, and why a completed form is not the same as a verified one.
5 min read Updated
MITRE ATLAS: the AI adversarial threat matrix, explained
What MITRE ATLAS actually is: its 16 tactics and 221 techniques for attacks on AI systems, its origin as the 2020 Adversarial ML Threat Matrix, how it relates to ATT&CK, and why prompt injection and MCP/agent-tool abuse now sit inside it.
6 min read Updated
MITRE ATT&CK for Enterprise: the 15 tactics, explained
MITRE ATT&CK for Enterprise — the 15 tactics in the current v20 matrix, the 2026 split of Defense Evasion into Stealth and Defense Impairment, and how tactics, techniques and sub-techniques fit together.
6 min read Updated
MITRE ATT&CK for ICS: the adversary tactics and techniques matrix, explained
MITRE's ATT&CK for ICS knowledge base — the 12 tactics and current technique/sub-technique counts in the v20 matrix, how it differs from ATT&CK Enterprise, and how asset owners use it.
4 min read Updated
MITRE CAPEC: Common Attack Pattern Enumeration and Classification, explained
What CAPEC actually is: a CISA-sponsored, MITRE-maintained catalog of 559 attacker methods (v3.9), how it differs from CWE and ATT&CK, its abstraction levels, and the dedicated ICS attack-pattern view.
5 min read Updated
MITRE D3FEND: the defensive countermeasure knowledge graph, explained
MITRE D3FEND — the NSA-funded, MITRE-managed knowledge graph of cybersecurity countermeasures: what the name stands for, its seven defensive tactics, the Artifact Ontology, and how it complements MITRE ATT&CK.
4 min read Updated
MITRE EMB3D: the embedded device threat model, explained
What MITRE's EMB3D framework actually is: its three linked knowledge bases (properties, threats, mitigations), who built it, its version history through v2.0.2, and how it relates to ATT&CK, CWE and CVE.
5 min read Updated
Modbus protocol security: why it has none, and what to do about it
Why Modbus — still the most common OT/ICS protocol on the plant floor — has no built-in authentication or encryption, what CISA's and vendors' advisories show that gap actually costs, and the segmentation, function-code filtering and Modbus/TCP Security options that compensate for it.
6 min read Updated
MQTT security: why the spec only says 'should,' and what happens when vendors skip it
MQTT 5.0 recommends authentication and TLS but does not require either, leaving broker security entirely up to the implementer. What five 2024-2026 CISA ICS advisories against real MQTT-connected products found when vendors shipped it open anyway.
5 min read Updated
NERC CIP-002: BES Cyber System categorization, and the CIP-002-8 revision already on the way
What NERC Reliability Standard CIP-002-5.1a requires for identifying and categorizing BES Cyber Systems as high, medium or low impact — why CIP-002-6 was withdrawn in 2021, and how the FERC-approved CIP-002-7 and CIP-002-8 revisions, both effective 2028, fit together.
7 min read Updated
NERC CIP-003: security management controls, explained
What NERC Reliability Standard CIP-003-9 requires — the 15-month cyber security policy review, the CIP Senior Manager and delegation requirements, Attachment 1's six-section low impact cyber security plan — plus the FERC-approved CIP-003-11 successor and its 2029 compliance date.
8 min read Updated
Questions about this page?