Guides
Each guide explains one task and links to the tool or data that does it. Numbers come from NIST's published data; editorial judgment is labeled as such.
Architecture reviews
Scoping and running security design reviews that end in traceable findings.
| Sheet | Title |
|---|---|
| AR-101 | How to run a security architecture reviewA practical workflow for security design reviews, from scoping and diagrams to findings traced to NIST SP 800-53, CSF 2.0 and SP 800-171 controls. |
Threat modeling
Data-flow diagrams, STRIDE per element, and turning threats into controls.
| Sheet | Title |
|---|---|
| TM-101 | STRIDE threat modeling, with a worked exampleHow to apply STRIDE per element to a data-flow diagram, with a worked example of a document upload service and candidate NIST SP 800-53 controls for each threat. |
Frameworks and controls
NIST SP 800-53, CSF 2.0 and SP 800-171 Rev. 3: how they relate, from the official data.
| Sheet | Title |
|---|---|
| FW-101 | NIST SP 800-53 vs. SP 800-171 Rev. 3, measured from the source dataHow SP 800-171 Rev. 3 derives from SP 800-53, with counts computed from NIST's OSCAL releases, the source-control links, and what that means for system design. |
| FW-102 | The CSF 2.0 to SP 800-53 mapping, and how to use it in designWhat NIST's official CSF 2.0 to SP 800-53 Rev. 5.2.0 informative references contain, measured from the CPRT export, and how architects can use them without overreading. |
Role and career
What the role involves, what it pays according to federal statistics, and which credentials fit.
| Sheet | Title |
|---|---|
| CR-101 | What an IT security architect does, and what federal data says about payThe security architect role through the NICE work role and its real deliverables, with federal wage statistics and an honest note on why salary figures disagree. |
| CR-102 | Security architect certifications compared, from the issuers' own pagesISSAP, Microsoft SC-100, CompTIA SecurityX and AWS Security Specialty side by side, with prerequisites and exam details checked on issuer pages. |