MITRE ATT&CK Framework

Knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and defense.

Analysis

Adopt and Maintain the ATT&CK Knowledge Base: Organizations must use the MITRE ATT&CK knowledge base to map adversary tactics, techniques, and procedures (TTPs) observed in real-world incidents. This includes referencing the latest version of the ATT&CK matrices (Enterprise, Mobile, ICS) and integrating updates as released by MITRE. MITRE ATT&CK Official Site MITRE ATT&CK Design and Philosophy

Map Security Controls to ATT&CK Techniques: Security teams are required to align their detection, prevention, and response controls to specific ATT&CK techniques and sub-techniques, ensuring coverage across all relevant adversary behaviors. MITRE ATT&CK for Enterprise Matrix MITRE ATT&CK Framework Guide

Document and Version Security Mappings: All mappings, mitigations, and threat intelligence must be versioned and documented according to ATT&CK’s object versioning system, ensuring traceability and consistency as the framework evolves. MITRE ATT&CK Design and Philosophy

Leverage ATT&CK for Threat Modeling and Emulation: Organizations should use ATT&CK to create adversary emulation scenarios, test defenses, and validate detection capabilities against known techniques. MITRE ATT&CK Official Use Cases

Complexity and Scale: The breadth of the ATT&CK framework (hundreds of techniques and sub-techniques) makes comprehensive mapping and ongoing maintenance resource-intensive, especially for large or complex environments. MITRE ATT&CK Framework Guide Fidelis Security MITRE ATT&CK Overview

Data Source Limitations: Many organizations lack the necessary telemetry or logging to fully map ATT&CK techniques, particularly for advanced or lateral movement tactics. MITRE ATT&CK Framework Guide

Keeping Pace with Updates: The ATT&CK framework is updated regularly, requiring organizations to continuously review and update their mappings and controls. MITRE ATT&CK Versioning

Real-World Example: The 2021 SolarWinds supply chain attack highlighted the challenge of mapping novel attack vectors to existing ATT&CK techniques, requiring rapid updates and re-mapping by affected organizations. MITRE ATT&CK Blog: SolarWinds and ATT&CK CISA SolarWinds Advisory

Establish a Cross-Functional ATT&CK Mapping Team: Involve threat intelligence, SOC, and incident response teams to ensure comprehensive and accurate mapping. MITRE ATT&CK Implementation Guide Picus Security ATT&CK Guide

Automate Mapping and Detection: Use SIEM, SOAR, and EDR tools that natively support ATT&CK mappings to automate detection and response. MITRE ATT&CK Tools & Resources MITRE ATT&CK Navigator

Regularly Review and Update Mappings: Schedule periodic reviews to incorporate new ATT&CK techniques and update existing mappings as the framework evolves. MITRE ATT&CK Versioning

Leverage Community Contributions: Participate in and utilize community-driven updates and shared mappings to accelerate adoption and improve coverage. MITRE ATT&CK Community

April 2022 (v11.3): Added 2 new techniques, 10 new sub-techniques, and updated 144 techniques/sub-techniques in the Enterprise matrix. MITRE ATT&CK Release Notes Picus Security ATT&CK Guide

Data Components Expansion: Introduction of data components to provide more granular context for data sources, improving detection mapping. MITRE ATT&CK Data Sources

Versioning and Release Process: ATT&CK objects (techniques, groups, software, mitigations) now follow a strict MAJOR.MINOR versioning system, with updates only at scheduled releases. MITRE ATT&CK Design and Philosophy

Compliance Deadlines: While ATT&CK is not a regulatory mandate, organizations are expected to align with the latest version as part of best practice frameworks and defense requirements. MITRE ATT&CK Official Site

NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations; references ATT&CK for threat modeling and control mapping. NIST SP 800-53

NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal Systems; uses ATT&CK for mapping adversary techniques to required controls. NIST SP 800-171

CMMC (Cybersecurity Maturity Model Certification): Requires mapping of security controls to adversary behaviors, often leveraging ATT&CK. CMMC Model Overview

Overlap and Interaction: These frameworks use ATT&CK to inform control selection, threat modeling, and incident response, ensuring a common language and approach across defense and federal sectors. MITRE ATT&CK and NIST

Defense Sector Adoption: The defense industry uses ATT&CK as a standard for adversary emulation, red teaming, and security control validation, improving threat detection and response. MITRE ATT&CK for Defense Fidelis Security MITRE ATT&CK Overview

Improved Threat Intelligence Sharing: ATT&CK provides a common taxonomy for sharing threat intelligence across organizations and agencies, enhancing collective defense. MITRE ATT&CK Community

Case Study: The U.S. Department of Defense and major defense contractors have integrated ATT&CK into their cyber defense operations, leading to more effective detection of advanced persistent threats (APTs). MITRE ATT&CK in DoD CISA ATT&CK Integration

2025-12-01 — D3 Security reports MITRE's 2026 plan to deprecate Defense Evasion (TA0005), splitting it into Stealth (hiding activities) and Impair Defenses (disrupting tools), requiring SOCs to update mappings, playbooks, and vendor tools[2]. (source)
2025-11-13 — Picus Security analyzes v18 updates, highlighting improved SOC visibility, cross-tactic correlations, and future 2026 changes like splitting Defense Evasion (TA0005) into Stealth and Impair Defenses, plus an ATT&CK Advisory Council[3]. (source)
2025-10-28 — MITRE released ATT&CK v18 in October 2025, updating Techniques, Groups, Campaigns, and Software across Enterprise, Mobile, and ICS, with major defensive changes replacing Detections with Detection Strategies and Analytics, and deprecating Data Sources[1]. (source)

NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
Law on Cybersecurity of Vietnam — Vietnam, Active
Austria NIS2 Act — Austria, Upcoming
Luxembourg NIS2 Transposition — Luxembourg, Active
EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18

Generate the policy: CIS Controls policy generator (generatepolicy.com)
Buy the policy pack: Cis Controls Bundle (cyberpolicy.shop)
Build it yourself: Build Series Vol. 07 — Endpoint Hardening & Configuration (ciso.diy)