Cyber Resilience

← ISO 27001 Annex A

A.5.36 Organizational

Compliance with policies, rules and standards for information security

AttributesPreventive C·I·A Identify Protect Legal and compliance Information security assurance Governance and Ecosystem

Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?

The implementation guidance for this control is published in ISO/IEC 27002:2022 and is not reproduced here. The structured attributes and the cross-walk rationales below are derived facts and our own AI-authored analysis.

Mapped NIST 800-53 r5 controls (15)

Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

AU-6→P CA-2←M →M CA-5←M →M CA-7←M →P CM-11←P CM-6←M MA-4←P PM-4←P PS-6←P PS-8←P

Why these map — AI rationale (under review)

CA-2mostlyaligns with — Both controls require periodic assessment of security controls against defined requirements and the documentation of findings.
CA-5mostlyaligns with — Both controls mandate the identification, tracking, and timely completion of corrective actions to address deficiencies discovered during reviews.
AU-6partialaligns with — Both controls require the review and analysis of evidence to determine whether security requirements are being met and to report results.
CA-7partialaligns with — Both controls emphasize ongoing monitoring and review of security control effectiveness, including the use of automated mechanisms where feasible.
SI-2partialaligns with — Both controls require the identification of non-conformities, determination of root causes, and implementation of corrective actions to restore compliance.
SI-2covers — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Aligned NIST CSF 2.0 outcomes (18)

NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

GV.OV-02gov GV.OV-03gov GV.PO-02gov GV.RR-02gov ID.IM-01gov ID.IM-03gov

Why these map — AI rationale (under review)

GV.OV-03mostlyaligns with — The ISO control's requirement to review policy compliance, identify root causes of deviations, and implement corrective actions directly supports evaluating and adjusting organizational cybersecurity risk management performance.
ID.IM-01mostlyaligns with — By mandating regular reviews of policy adherence and follow-up corrective actions, the control provides a structured mechanism for identifying improvements from evaluations of security controls.
GV.PO-02partialaligns with — The control's emphasis on reviewing compliance with policies and enforcing corrective actions when deviations occur helps ensure policies remain effective and are updated to reflect changing requirements.
GV.RR-02partialaligns with — Assigning managers and owners the responsibility to review compliance and drive corrective actions reinforces the establishment and communication of clear roles for cybersecurity risk management.
ID.IM-03partialaligns with — The ISO requirement to detect non-compliance during operational reviews and apply corrective actions aligns with identifying improvements from the execution of day-to-day security processes and procedures.
GV.OV-03implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
GV.PO-02implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
GV.RR-02implements — Assessed as NOT holding by the authoring instrument at v1.19-2026-08-23. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.IM-01implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.
ID.IM-03implements — Assessed as NOT holding by the authoring instrument at v1.22-2026-08-29. This row records a tested non-relation; it is not a graded claim and carries no rationale, because the instrument produced none when the verb did not hold.

Related OWASP ASVS 5.0 requirements (5)

Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

V11.1.1←P V16.1.1←P V2.1.1←P V6.1.1←P V8.1.1←P

Related weaknesses / CWE (9)

Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

CWE-1076←M →P CWE-284→P CWE-285→P CWE-693→P CWE-695→P CWE-710←P →P CWE-732→P

Why these map — AI rationale (under review)

CWE-1076finds — Directly requires compliance with rules and standards, which include coding and documentation conventions.
CWE-284finds — Periodic compliance reviews and corrective-action tracking detect and close gaps where access-control rules are not enforced, reducing the window in which improper access control can be exploited.
CWE-285finds — By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.
CWE-693finds — Systematic verification that security mechanisms operate according to defined standards reduces the likelihood that protection mechanisms are bypassed or disabled.
CWE-695finds — Compliance monitoring verifies adherence to coding rules but does not prevent the weakness itself.
CWE-710finds — Enforces adherence to coding standards as part of policy compliance.
CWE-732finds — Regular policy-compliance audits surface incorrect or overly permissive file and resource permissions, prompting timely correction before they can be abused.

Mitigated MITRE ATT&CK techniques (434)

Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1001←M T1001.001←M T1001.002←M T1001.003←M T1003→P T1003.001→P T1003.003→P T1003.005→P T1003.006→P T1006←M →P T1014←M T1021.004→P T1027.001←M T1027.002←M T1027.004→P T1027.005←M T1027.006←M T1027.007←M T1027.008←M T1027.009←M T1027.010←M T1027.011←M T1027.013←M T1027.014←M T1027.016←M T1027.018←M T1030←M T1036←M T1036.001→P T1036.003←M →P T1036.005←M T1036.007←M T1036.008←M T1036.009←M T1036.011←M →P T1036.012←M T1037.003→P T1037.004→P T1037.005→P T1041→P T1046→P T1048.002→P T1053→P T1053.003→P T1053.005←M →P T1053.007→P T1055←M →P T1055.001←M T1055.002←M →P T1055.003←M →P T1055.004←M T1055.005←M T1055.008←M T1055.009←M T1055.011←M T1055.012←M T1055.013←M T1055.014←M T1055.015←M T1056.004→P T1059.008→P T1068←M T1070←M →P T1070.003←M T1070.004←M →P T1070.006←M T1070.007←M →P T1070.008←M T1070.009→P T1070.010←M T1071←M T1071.001←M T1071.004←M T1078→P T1078.001←M →P T1078.002→P T1087.003→P T1090←M T1090.001→P T1090.003←M T1095←M T1098←P →P T1098.001→P T1098.003→P T1098.004→P T1098.005←M →P T1102←M T1102.001→P T1102.002←M →P T1102.003→P T1110.001→M T1110.004→P T1111←M →P T1112←M T1114.002→P T1114.003→P T1127←M T1127.001←M →P T1127.003←M →P T1132.002←M T1133←M T1134←M T1134.001←M T1134.002←M T1134.003←M T1134.004←M T1134.005←M →P T1136.003→P T1137.001→P T1137.002→P T1137.003→P T1137.004→P T1137.005→P T1137.006→P T1202←M T1204.004←M T1205.002→P T1207←M T1211←M T1213.005→P T1216←M →P T1216.001←M T1216.002←M T1218←M T1218.002→P T1218.003→P T1218.004→P T1218.005←M →P T1218.007←M T1218.008←M →P T1218.009←M →P T1218.010←M T1218.011←M T1218.012←M →P T1218.013←M T1218.014→P T1219.002→P T1219.003←M T1220←M T1221←M T1222←M T1222.001←M →P T1222.002←M →P T1480.001←M T1484←M →P T1484.001←M →P T1484.002←M →P T1485.001←M →P T1486→M T1489←M T1490←M →P T1491.001→P T1496→P T1496.001→P T1496.002→P T1496.003→P T1497←M T1498.002→P T1499←F →P T1499.004→P T1505.002→P T1505.003→P T1505.004→P T1525→P T1530→P T1531→P T1535←M →P T1537←M T1538→P T1539←F T1542←M T1542.002←M T1542.003←M →P T1542.005→P T1543.002→P T1543.003→P T1543.004→P T1546→P T1546.001→P T1546.002→P T1546.003→P T1546.006→P T1546.007→P T1546.008→P T1546.009→P T1546.010→P T1546.011→P T1546.012←P →P T1546.013→P T1546.015→P T1546.016→P T1546.017→P T1547.001→P T1547.002→P T1547.003→P T1547.004→P T1547.010→P T1547.012→P T1547.013→P T1547.014→P T1547.015→P T1548.002←M →P T1548.003←M →P T1548.005→P T1548.006←M →P T1550←F T1550.001←F T1550.002←F T1550.003←F T1552.001→P T1552.006→P T1552.008→P T1553←M →P T1553.001←F T1553.002←M T1553.003←M →P T1553.004←M →P T1553.005←M T1553.006←M →P T1554→P T1555.004→P T1555.006→P T1556←M →P T1556.001←M →P T1556.002→P T1556.003←M →P T1556.005→P T1556.006←M →P T1556.007←M →P T1556.008→P T1556.009←M →P T1557.001→P T1558.001→P T1561→P T1561.001→M T1561.002→P T1563.002→P T1564←M T1564.004←M T1564.009→P T1565→P T1565.001→P T1565.002→P T1566.003←M T1567.001→P T1567.004→P T1568←M T1568.001→P T1568.003←M T1569→P T1569.003→P T1571←M →P T1572←M T1574←M T1574.001←M →P T1574.004←M T1574.005→P T1574.008→P T1574.009→P T1574.010→P T1574.013←M T1578←M →P T1578.001←M T1578.002←M T1578.003←M →M T1578.004←M →P T1578.005←M →P T1599←M T1599.001←M T1600←M T1600.001←P T1601.001←M T1601.002←M T1602.002→P T1606←M T1606.001←M T1606.002←M T1610←P T1612←M →P T1620←M T1621←M →P T1622←F T1647←P T1665←M T1666←M T1671→P T1677←M →P T1678←M T1679→P T1684.002←M T1685←M →M T1685.001←M →P T1685.002←M →P T1685.003←M T1685.004←M →P T1685.005←M →M T1685.006←M →P T1686←F →P T1686.001←M →P T1686.002←M →P T1686.003←M →P T1687←M T1688←M T1689←M T1690←M

Why these map — AI rationale (under review)

T1003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as credential-handling or tool-use rules, thereby detecting some instances of the technique after the fact; this is limited because the control is governance-oriented, does not mandate specific detection mechanisms for credential dumping itself, and many executions (especially by testers or custom tools) may evade policy-review triggers.
T1003.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as credential-protection or least-privilege rules whose violation enables LSASS dumping, but does not itself instrument or monitor for the technique in flight.
T1003.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on credential protection or backup handling, which would flag the post-exploitation artifacts or tools named in T1003.003 after they have run; this is genuine but only a minority slice of the technique's full surface (prevention via access controls lives in other clauses).
T1003.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on credential handling and access, which would flag the presence or misuse of cached domain credential stores after the fact; this is a genuine but minority slice given the control's governance/review focus rather than real-time technique detection.
T1003.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as privilege or replication controls, which would detect the anomalous use of DCSync by privileged accounts, but this is indirect governance-level detection rather than specific, continuous, or technical monitoring of the technique itself.
T1006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on access controls and monitoring, which would detect use of direct volume access techniques that violate those rules; however, it is governance-oriented, not a technical detection mechanism, and only catches what the chosen review scope and tools actually measure.
T1021.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on SSH enablement, key management, or account usage, but this is governance-oriented compliance checking rather than real-time or technical detection of the live adversary technique.
T1027.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies prohibiting or restricting unapproved compilation tools and source-code delivery, but this is governance-level detection of policy violations rather than direct runtime or code-level detection of the T1027.004 technique itself.
T1036.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with code-signing or signature-validation rules, thereby detecting the technique's artifacts when they violate policy; this is limited to a governance/review slice rather than continuous or technical detection of the mimicry itself.
T1036.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on security mechanisms; renamed utilities evading those mechanisms can be caught as non-compliance during such reviews, but this is indirect, after-the-fact, and depends on what the organization chooses to measure.
T1036.011detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on process behavior or masquerading, but does not mandate or guarantee detection of in-memory argument overwriting itself.
T1037.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant logon script configurations as policy violations, but this is governance-oriented compliance checking rather than runtime detection of the T1037.003 technique in flight.
T1037.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant modifications to RC scripts as policy violations, but this is limited to post-modification compliance checks rather than real-time detection of the technique itself.
T1037.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant startup items or persistence mechanisms if they violate defined policies/standards, but this is limited to post-placement compliance checks rather than real-time detection of the technique itself.
T1041detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration, data handling, or C2 restrictions, thereby detecting the anomalous use of a C2 channel for exfiltration as a policy violation; this is only a minority slice because the control is governance-oriented, not a dedicated monitoring or anomaly-detection mechanism that would catch the technique in flight across its full scope.
T1046detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies prohibiting or restricting network scanning tools and unauthorized discovery activity, but this is governance-level detection of policy violations rather than direct, timely detection of the TTP itself.
T1048.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with security policies/standards on data handling and exfiltration channels; this can detect the technique when it violates an applicable rule, but the control is governance-oriented, not a dedicated monitoring mechanism, and many instances (especially non-violating or stealthy uses of baked-in protocols) remain undetected.
T1053detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant scheduled tasks/jobs as policy violations, but this is governance-oriented compliance checking rather than direct, continuous, or technical detection of the T1053 technique itself.
T1053.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant cron jobs used for persistence when those jobs violate defined policy or standards, but this is limited to post-placement compliance checks rather than real-time detection of the technique itself.
T1053.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant scheduled-task creation or hidden tasks as policy violations, but this is governance-level detection after the fact and does not mandate or guarantee specific technical detection of the T1053.005 technique itself.
T1053.007detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant container orchestration jobs implementing the technique, plus recording and escalation of findings; this is genuine but only a slice because the control is governance-oriented, not a dedicated monitoring capability, and does not mandate instrumentation depth or real-time detection of the abuse.
T1055detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies mandating process-injection defenses, but does not itself mandate or perform detection of the T1055 technique in flight or in artifacts.
T1055.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration or operations, which may include anomalous process behavior indicative of PE injection; however, it is a governance-level compliance check rather than targeted monitoring of the technique itself.
T1055.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on process injection defenses, but does not itself mandate or perform detection of the in-flight T1055.003 technique
T1056.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies prohibiting or restricting hooking mechanisms for credential theft, but this is indirect governance-level detection of policy violations rather than technical detection of the in-process technique itself.
T1059.008detects — A.5.36 requires reviews (with automatic tools considered) that surface non-compliance with policies/standards, which can include CLI abuse on network devices if it violates configuration or hardening rules, but this is indirect governance-level detection after the fact rather than real-time technique observation.
T1070detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards, which can detect selective artifact tampering when it violates logging or integrity rules, but this is limited to policy-defined scope and does not broadly instrument for the technique itself.
T1070.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with deletion-related rules or standards, but does not mandate detection of the T1070.004 technique itself or of file-deletion artifacts in real time or in general.
T1070.007detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can detect post-facto deviations such as unauthorized clearing of network connection artifacts when those actions violate defined rules, but it is not scoped to real-time technique detection and depends on whether the organization explicitly requires logging/preservation of those artifacts.
T1070.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on persistence-related artifacts or cleanup actions, but this is indirect governance-level detection of policy violations rather than technical detection of the T1070.009 technique itself.
T1078detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on account management and credential hygiene, which would detect some abuse of valid accounts (especially inactive ones or policy violations), but this is governance-level and does not mandate or perform technical detection of the technique in flight.
T1078.001prevents — A.5.36 requires reviews that surface non-compliance with policies (including those mandating default-account changes) plus identification, evaluation, implementation and verification of corrective actions, which stops many but not all instances of the technique from succeeding; it does not itself enforce the underlying policy or remove default accounts at creation time.
T1078.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on credential handling and account management, which would detect some instances of domain account abuse after the fact; this is limited to policy-violation detection rather than direct technique observation.
T1087.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on information access and enumeration, which would detect use of Get-GlobalAddressList or similar to dump GALs when that violates policy; this is limited to policy-defined scopes and post-facto review rather than real-time detection of the technique itself.
T1090.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant proxy usage or traffic-redirection tools when they violate policy, with follow-on root-cause and corrective-action steps; this is genuine detection of the technique but only a minority slice because the control is governance-oriented, not a dedicated monitoring or anomaly-detection mechanism that would catch most in-flight internal-proxy C2.
T1098detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as those governing account permissions, credential lifetime, and password policies; this detects some T1098 activity (e.g., iterative password updates or permission changes that violate rules) but leaves the bulk of stealthy or policy-compliant manipulations (especially post-compromise on diverse platforms) unreached.
T1098.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can detect post-addition credential anomalies or unauthorized additions when they violate defined rules, but the control is governance-oriented, does not mandate specific detection mechanisms for this technique, and leaves most real-time or technical detection to other controls.
T1098.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as unauthorized IAM policy or role changes, but the control is scoped to policy/rule conformance reviews rather than real-time or comprehensive detection of the adversarial technique itself.
T1098.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on SSH key management and authorized_keys modifications, but this is limited to policy-defined review scope and does not guarantee detection of the in-flight or post-modification technique itself.
T1098.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on device registration/MFA enrollment, but this is after-the-fact governance review rather than real-time detection of the adversarial technique itself, leaving most execution paths unreached.
T1102.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies banning or restricting unauthorized external web service use for C2, but this is governance-oriented compliance checking rather than direct technique detection and does not reach most in-flight dead-drop resolver traffic.
T1102.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies banning or restricting unauthorized external web service use for C2, but this is governance-level detection of policy violations rather than direct, reliable detection of the live T1102.002 technique itself
T1102.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies banning or restricting unauthorized external web service use for C2, but does not itself perform or mandate the detection instrumentation that would catch the technique in flight
T1110.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with password policies or lockout rules, which would flag excessive guessing attempts in many environments, but the control is governance-oriented, does not mandate specific detection instrumentation, and leaves many guessing vectors (e.g., distributed, low-and-slow, or non-policy-triggering on LDAP/Kerberos) unreached.
T1110.001prevents — A.5.36 requires managers to review compliance with the information security policy (including password complexity and account lockout rules that directly constrain guessing), identify causes of non-compliance, and implement timely corrective actions that close the gaps enabling the technique.
T1110.001responds — A.5.36 requires managers to detect non-compliance via reviews (including of login failure policies that can lock accounts after guessing attempts), identify causes, implement corrective actions, and verify effectiveness, which directly matches the `responds` verb of acting on an underway technique (password guessing triggering failures/lockouts) through containment via policy enforcement and eradication of the non-compliant state.
T1110.004detects — A.5.36 requires reviews (including automated tools) that can surface non-compliance with policies such as login failure handling or account lockout rules, which would flag anomalous credential-stuffing attempts; this is only a slice of the technique's full surface (e.g., it does not directly instrument authentication logs or network flows).
T1110.004prevents — A.5.36 requires reviews that surface non-compliance with policies (including auth-related ones that can block stuffing via lockouts/rate limits) plus corrective action to restore compliance, which can prevent the technique in some policy-enforced environments but does not itself stop credential overlap or the attack vector.
T1111detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with MFA-related policies or standards, which would detect some T1111 enablers such as missing endpoint protection or unsecured out-of-band channels; this is limited to a governance slice rather than direct technique observation.
T1114.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on credential use, Exchange/Office 365 access, and data handling, thereby detecting the technique when it violates those rules; this is limited to policy-violation detection rather than direct technique observation.
T1114.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on email rules or forwarding, but this is governance-level detection of policy violations rather than technical detection of the T1114.003 technique itself, leaving most in-flight or hidden rule abuse unreached.
T1127.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as application control or allowed binaries, which would flag anomalous MSBuild abuse in many environments, but the control is governance-oriented, does not mandate specific detection instrumentation for this technique, and leaves substantial implementation-dependent gaps.
T1127.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies/standards; this can detect anomalous or unauthorized use of JamPlus as a build tool for malicious .jam-based execution, but the clause is governance-oriented, not a technical detection mechanism, and does not guarantee coverage of this specific technique.
T1134.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can discover SID-History Injection after the fact when it violates access-control or privileged-account rules, but the clause is governance-oriented, not a monitoring mechanism, and does not mandate instrumentation that would catch the technique in most executions.
T1136.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as unauthorized cloud account creation, but the clause is scoped to policy/rule/standard conformance rather than real-time or comprehensive technique detection across IaaS/SaaS/Office Suite platforms.
T1137.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with macro-related policies, which would detect some instances of this technique after the fact; it is not required to instrument for or surface the technique itself in real time or in all cases.
T1137.001prevents — A.5.36 requires reviews that surface non-compliance with macro/security policies plus corrective actions that can disable or remove the malicious template macro, thereby stopping the persistence technique from executing on future app starts; it is not a preventive barrier at creation or load time and depends on policy content plus timely review cadence, leaving a genuine slice unreached.
T1137.002detects — A.5.36 requires reviews (including automated measurement tools) that can surface non-compliant registry settings such as the Office Test key when those reviews are scoped to configuration or persistence indicators, but the clause itself sets no specific detection for this technique and the remainder (reviews that never examine this key or Office startup behavior) is implementation-defined rather than a bounded named slice.
T1137.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as secure configuration or code execution rules, which would include detecting malicious Outlook forms once present; partial because the clause sets a governance/review process whose actual coverage depends on what the organization chooses to measure and is not guaranteed to catch this specific persistence technique.
T1137.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies such as secure configuration or code execution rules; this can discover the anomalous Outlook Home Page persistence artifact after it is present, but the clause's governance-oriented mechanism reaches only a slice of the technique's possible indicators rather than mandating detection of the HTML execution itself.
T1137.005detects — A.5.36 requires reviews (including automated measurement tools) that surface non-compliance with policies/standards; this can discover malicious Outlook rules as a policy violation once present, but the clause is governance-oriented, not a technical detector, and does not mandate instrumentation for the technique itself.
T1137.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant add-ins used for persistence, but this is limited to policy/rule violations within the review scope rather than reliably detecting the technique itself in all cases.
T1205.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies/standards prohibiting or restricting raw socket filters, libpcap usage, or related elevated-privilege behaviors, but the technique's passive/low-activity nature and limited visibility mean only a slice is reliably detectable via compliance checks.
T1213.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies such as data-handling or acceptable-use rules; this can discover messaging apps containing or leaking the listed sensitive items, but only as a governance/review slice rather than broad, continuous, or technical detection of the technique itself.
T1216detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as application control or signed-script rules, thereby detecting proxy-execution abuse after the fact; it is not a dedicated monitoring control and the review cadence leaves real-time or comprehensive coverage as an implementer-chosen slice
T1218.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant configurations or artifacts such as unauthorized .cpl registrations or policy-violating executables, but does not mandate detection of the in-flight technique itself or its artifacts in real time.
T1218.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as secure configuration or application control rules; this can detect CMSTP abuse when it violates those rules, but the clause is governance-oriented, does not mandate specific detection of the technique itself, and leaves most in-flight or policy-conformant abuse undetected.
T1218.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as those prohibiting or restricting living-off-the-land binaries like InstallUtil; this surfaces the technique when it violates a rule, but the clause is governance-oriented and does not mandate specific detection mechanisms or coverage depth.
T1218.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as application control or secure execution standards, which would detect mshta.exe abuse when it violates those rules; this is only a slice because the control is governance-oriented, depends on what the org actually defines/monitors, and does not mandate specific detection of the technique itself.
T1218.008detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant use of signed binaries such as odbcconf.exe for proxy execution, but this is limited to post-facto compliance checks rather than real-time detection of the technique itself.
T1218.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as application control or secure configuration baselines, which would include anomalous use of signed binaries like Regsvcs/Regasm for proxy execution; this is a genuine but minority slice of the technique's full surface (e.g., real-time process execution or LOLBAS patterns are outside the clause's governance/review focus).
T1218.012detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can detect abuse of verclsid.exe as a policy violation if application control or signed-binary rules are in scope, but the clause is governance-oriented and does not mandate specific detection of the technique itself.
T1218.014detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant use of signed binaries like mmc.exe for proxy execution, plus root-cause analysis of any discovered violations, but the clause is governance-oriented and does not mandate specific detection instrumentation for this technique.
T1219.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant use of allowed remote desktop tools for C2, plus recording and reporting of findings; this is genuine but only a slice because the clause is governance-oriented, does not mandate specific detection mechanisms or continuous monitoring, and leaves most in-flight technique execution unseen.
T1222.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with security policies on permissions/ACL management, which would detect post-modification violations or anomalous permission changes when they breach defined rules.
T1222.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with permission-related policies or standards, which would detect post-facto use of chown/chmod to alter ACLs in violation of those rules; it is only a slice because the control is governance-oriented, does not mandate specific detection instrumentation for the technique itself, and many instances of T1222.002 would not trigger a policy-violation review.
T1484detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; domain/tenant policy modifications are a detectable form of non-compliance when they deviate from approved baselines, but the clause is silent on real-time detection of temporary or stealthy changes and does not mandate instrumentation for the technique itself.
T1484.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on GPO access controls and modifications, but this is limited to scheduled/periodic compliance checks rather than real-time detection of the technique in flight, with a large remainder of stealthy or timely adversary modifications going unseen until the next review cycle.
T1484.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on trust configuration and federation settings, but this is limited to scheduled or periodic compliance checks rather than real-time detection of the adversarial technique itself.
T1485.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; modifying lifecycle policies to trigger deletion would typically violate data-retention or backup policies and can therefore be discovered during such reviews, but the clause is silent on real-time detection of the API call or policy change itself and the remainder (in-flight or un-reviewed changes) is large.
T1486recovers — A.5.36 requires identifying non-compliance (including with backup/recovery requirements per the event-lane anchor for A.8.13), evaluating/implementing/reviewing corrective actions in a timely risk-based manner, and recording/reporting results; this directly supports recovering from realized T1486 impact via corrective restoration of encrypted data, with the same named remainder (unrecoverable window since last backup) as the A.8.13 anchor.
T1486responds — A.5.36 requires managers to review for non-compliance (including realized ransomware events that violate availability/integrity policy), identify causes, implement corrective actions, and verify effectiveness, which directly enacts the containment/eradication acts that `responds` names once the technique is underway.
T1490recovers — A.5.36 requires identifying non-compliance (including with backup/recovery rules), evaluating/implementing/reviewing corrective actions to restore compliance, and timely completion; this can recover inhibited recovery features (e.g., re-enabling WinRE, restoring shadow copies or policies) after T1490 runs, but only as a general process slice rather than a dedicated recovery mechanism.
T1491.001detects — A.5.36 requires reviews (including automated measurement tools) that surface non-compliance with policies/standards; internal defacement that violates integrity or configuration rules would be found during such reviews, but the clause is silent on real-time or technical detection of the technique itself and the remainder (attacks never reviewed or outside scoped reviews) is large.
T1496detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on resource use, which would detect some hijacking forms (e.g. unexpected compute or bandwidth consumption violating baselines), but this is limited to policy-defined checks rather than direct technique observation and leaves many hijacking variants (e.g. in unmanaged SaaS/containers) unreached.
T1496.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as resource-use or configuration baselines, thereby detecting compute hijacking when it violates those rules; this is limited to policy-defined scopes rather than universal detection of the technique itself.
T1496.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on resource usage, bandwidth consumption, or anomalous traffic, thereby detecting the technique when it violates such rules; this is limited to policy-defined scopes and does not guarantee detection of all instances or variants.
T1496.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can discover anomalous SMS traffic or cost spikes violating availability or anti-fraud rules, but the control is governance-oriented, not a dedicated monitoring mechanism, and only surfaces what the org chose to policy-ize and review.
T1498.002detects — A.5.36 requires reviews (with automatic measurement/reporting tools considered) that can surface non-compliance with policies on network security, traffic rules, or DoS protections, thereby detecting anomalous reflection/amplification activity when it violates those baselines; this is a genuine but minority slice because the control is governance-oriented, not a dedicated monitoring mechanism, and does not mandate instrumentation for the technique itself.
T1499detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with security requirements; an implemented Endpoint DoS would typically violate availability/integrity policies or standards and therefore be detectable during such a review, but the clause is silent on real-time detection of the attack itself and the review scope is set by the organization.
T1499.004responds — A.5.36 requires identifying non-compliance (including with availability requirements), investigating causes, implementing corrective actions, and verifying effectiveness once an incident occurs, which matches the `responds` verb for containing/eradication after the exploitation technique is underway; it is only partial because the clause is governance-oriented, does not itself perform technical containment or eradication, and depends on other controls for actual response actions.
T1505.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; a malicious transport agent would violate secure configuration and development rules and could be discovered during such reviews, but the clause is governance-oriented, not a dedicated detection mechanism, and does not guarantee coverage of runtime or in-pipeline abuse.
T1505.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as an unauthorized web shell on a managed web server, but this is limited to policy-defined scope, scheduled reviews, and what owners choose to measure rather than continuous or universal detection of the technique.
T1505.004detects — A.5.36 requires reviews (including automated measurement tools) that surface non-compliance with policies/standards; malicious IIS component installation would be non-compliant with secure configuration or change-management rules, so the clause's review process can detect it, but only where such policies exist and the review actually covers the IIS surface — a slice, not the bulk.
T1525detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure image handling or registry integrity, thereby detecting the implanted image as a policy violation; this is only a slice because the control is governance-oriented, depends on what the organization chose to require and scan for, and does not mandate specific detection of malicious implants or backdoors.
T1530detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with security configuration rules for cloud storage, thereby detecting misconfigurations that enable T1530; however, it is scoped only to compliance reviews within the organization's responsibility and does not broadly detect adversary access techniques or credential abuse after the fact.
T1531detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can discover post-facto account manipulations that violate account-management or availability rules, but the clause is governance-oriented, not a monitoring control, and many T1531 realizations (especially in ransomware pre-encryption) fall outside routine compliance reviews.
T1531responds — A.5.36 requires managers to review for non-compliance (including with policies on account management), identify causes, evaluate/implement/review corrective actions, and record/report them; this directly matches the `responds` verb of acting on an already-underway technique (account access removal as part of ransomware impact) via containment/eradication once discovered, but only partially as it is governance-oriented, depends on the review detecting it first, and does not itself perform technical response actions.
T1535detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards, which can discover unauthorized cloud resource creation in unused regions as a compliance violation; this is a genuine but minority slice of the technique (policy-driven detection after the fact, not continuous monitoring of all regions or behavioral anomalies).
T1538detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can detect anomalous or unauthorized dashboard use when it violates access or monitoring rules, but the control is governance-oriented and does not mandate specific detection of the T1538 technique itself.
T1542.003responds — A.5.36 requires managers to review for compliance, identify non-compliance causes, evaluate/implement/review corrective actions and record/report them; this directly matches the `responds` verb (containment/eradication once the bootkit technique is underway and discovered), but only for suspected cases where the organization already knows to review the boot area — the control's scope is governance-driven reviews rather than universal incident response to stealthy pre-OS persistence.
T1542.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on boot/image integrity or TFTP usage, plus recording/reporting of findings; this detects the technique after configuration manipulation but only where policy violations are observable in the reviewed scope, leaving most in-flight or pre-review abuse undetected.
T1543.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on service configuration and persistence mechanisms; this surfaces some instances of the technique (e.g. unauthorized .service files or generators) but is neither continuous nor guaranteed to catch all variants, especially those that mimic legitimate services.
T1543.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant service creation/modification as a policy violation, but this is governance-driven periodic review rather than real-time or comprehensive technical detection of the technique itself.
T1543.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant Launch Daemon plists or configurations as policy violations, but this is scoped only to whatever the org's own policies explicitly require and does not guarantee detection of the technique itself.
T1546detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant event-trigger configurations as policy violations, but this is limited to scheduled/governance reviews rather than real-time detection of the technique in flight and does not reach all platforms or creation/modification actions
T1546.001detects — A.5.36 requires reviews (including automated measurement tools) that surface non-compliance with policies/standards; a policy banning unauthorized Registry changes for persistence would let such reviews detect the T1546.001 modification as non-compliance, but the control itself sets no scope or mechanism guaranteeing discovery of this specific technique.
T1546.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant registry settings or unauthorized .scr executables used for persistence, but does not mandate instrumentation that would reliably catch the technique in real time or across all possible implementations.
T1546.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant WMI subscriptions as policy violations, but this is governance-driven discovery after the fact rather than dedicated technique-specific detection, leaving most in-flight or stealthy instances outside its scope
T1546.006detects — A.5.36 requires reviews (including automated measurement tools) that can surface non-compliance with policies such as secure development or binary integrity rules, thereby detecting the modified binary or added LC_LOAD_DYLIB as a policy violation; this is only a slice because the clause is governance-oriented, does not mandate specific detection mechanisms for the technique itself, and depends on whether the organization’s policies and review scope actually cover Mach-O header tampering on macOS endpoints.
T1546.007detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant registry entries or helper DLLs implementing this persistence technique, but only where those reviews are scoped to cover them and only after the technique has already been deployed.
T1546.008detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as secure configuration or change management, which would include unauthorized binary replacements or registry modifications used by T1546.008; this is only a slice because the control is governance-oriented, does not mandate specific detection mechanisms for runtime technique execution, and many instances (e.g., initial replacement or use at login) can evade periodic compliance reviews.
T1546.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration and AppCertDLLs misuse, but this is governance-level detection of policy violations rather than direct, reliable detection of the in-memory technique itself.
T1546.010detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as disabling AppInit_DLLs or enforcing secure boot, but this is indirect governance-level detection of configuration drift rather than runtime detection of the technique itself.
T1546.011detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration and shim usage, but does not mandate or guarantee detection of the adversarial technique itself once installed and in use.
T1546.012detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant Registry settings or IFEO abuse as policy violations, but this is governance-driven discovery after the fact rather than dedicated technique-specific detection, leaving most in-flight or stealthy abuse outside its scope
T1546.013detects — A.5.36 requires reviews (including automated measurement tools) that can surface non-compliant modifications to profiles or scripts as policy violations, but this is limited to post-facto compliance checks rather than real-time detection of the technique itself.
T1546.015detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as secure configuration or registry integrity, which would include anomalous COM Registry changes, but this is governance-driven periodic review rather than continuous or specific detection of the technique itself.
T1546.016detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure installation and script handling, thereby detecting some instances of this technique after the fact; it is not a monitoring control and does not address the bulk of in-flight or pre-execution installer abuse across Linux/macOS/Windows.
T1546.017detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant udev rules as a policy violation, but this is governance-driven periodic review rather than continuous or event-driven detection of the technique itself, leaving most in-flight abuse undetected until the next review cycle.
T1547.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can discover anomalous or unauthorized persistence entries in run keys/startup locations when those violate defined baselines, but the clause is governance-oriented, does not mandate specific detection mechanisms or coverage of all T1547.001 artifacts, and stops at identifying causes rather than guaranteeing discovery of the technique in flight.
T1547.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration and autostart mechanisms, which would detect the registry modification enabling T1547.002; extent is partial because the control is governance-oriented, depends on what the organization defines in its policies/standards, and does not mandate specific detection of this technique.
T1547.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as unauthorized registry changes for malicious time-provider DLLs, but this is limited to post-boot compliance checks rather than real-time detection of the technique itself.
T1547.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant registry modifications enabling Winlogon Helper DLL abuse, but only where those modifications violate an explicitly documented policy, rule or standard — leaving the bulk of stealthy or policy-silent abuse undetected.
T1547.010detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on boot-time loading, registry changes, or unauthorized DLLs, but this is governance-driven periodic review rather than continuous or specific detection of the T1547.010 technique itself.
T1547.012detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant print-processor additions or registry changes as policy violations, but this is governance-driven discovery after the fact rather than dedicated technique-specific detection.
T1547.013detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant autostart entries as policy violations, but the clause is silent on depth, frequency, or Linux-specific coverage and stops at discovery without mandating detection of the technique in flight.
T1547.014detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant registry changes such as a malicious Active Setup StubPath, but the clause is silent on depth, frequency, and whether the review actually inspects the specific HKLM path or execution artifacts, leaving most real-world instances undetected until an independent review occurs.
T1547.015detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on login-item hygiene or persistence mechanisms, but this is governance-driven periodic review rather than continuous or technical detection of the technique itself
T1548.002detects — A.5.36 requires reviews (including automated measurement tools) that can surface non-compliance with policies such as UAC configuration or related hardening standards, but does not mandate or guarantee detection of in-progress bypass technique executions or artifacts.
T1548.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards; sudoers misconfigurations and tty_tickets tampering are detectable as policy violations, but the clause is governance-oriented and does not mandate specific detection of the technique's runtime abuse.
T1548.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards; misconfigured JIT/impersonation/pass-role permissions that enable T1548.005 would be detectable as policy violations during such reviews, but the clause is silent on real-time detection of technique execution and the reviews are periodic rather than continuous.
T1548.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on TCC/permissions management, but does not mandate detection of the live adversarial technique itself and leaves most in-host abuse undetected.
T1552.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as insecure credential storage in files, plus follow-on identification of causes; this detects the realized technique in some cases but is scoped only to policy-compliance checks rather than broad or continuous discovery of the technique itself.
T1552.006detects — A.5.36 requires reviews (including automated measurement tools) that surface non-compliance with policies such as secure credential handling in GPP; this can detect the presence of the unsecured credential files the technique relies on, but the clause is silent on runtime detection of the enumeration or decryption steps themselves and the remainder (in-flight technique use) is large.
T1552.008detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies such as secure credential handling; this can detect chat-message credential sharing when it violates policy, but only for policy-violating instances that fall inside the chosen review scope and tooling, leaving the bulk of stealthy or non-policy-flagged cases unreached.
T1553detects — A.5.36 requires reviews (including automated measurement tools) that can surface non-compliance with policies on trust controls or certificate handling, thereby detecting some instances of the technique after the fact; this is limited to policy-level or configuration drift rather than real-time detection of the full range of subversions described.
T1553.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on trust/signature validation, which would include hijacked SIP/trust-provider components if they violate the policy; this is only a slice because the control is governance-oriented, depends on what the organization chooses to review/measure, and does not inherently instrument for the technique itself.
T1553.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with certificate-related policies or standards, which would detect anomalous root-certificate installation in many cases, but the clause is silent on real-time detection of the technique itself and leaves scope to the organization's chosen review methods.
T1553.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with code-signing policy rules, which would detect the modification technique when it violates the enforced policy.
T1554detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as unauthorized binary modifications, but the clause is scoped to policy/rule/standard conformance rather than continuous or specific detection of the T1554 technique itself.
T1555.004detects — A.5.36 requires reviews (with automatic measurement/reporting tools considered) that can surface non-compliant use of Credential Manager (e.g. via anomalous access or unapproved credential-dumping tools), but this is governance-driven periodic review rather than continuous detection of the technique itself.
T1555.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on credential handling and privilege use; this surfaces the technique after the fact when it violates those rules, but only where the review scope and tooling actually cover cloud API calls or secret-access anomalies, leaving most real-time or un-reviewed executions outside its reach.
T1556detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on authentication mechanisms, which would detect modifications to auth processes like PAM/LSASS/SAM when they violate those policies; this is limited to a slice because the control is governance-oriented, depends on what the org's policies actually require, and does not mandate continuous technical detection of the technique itself.
T1556.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with authentication-related policies/standards, which would include detecting a patched LSASS process or anomalous domain controller behavior if it violates those rules.
T1556.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant DLL registrations or anomalous filter behavior as policy violations, but this is governance-driven discovery after the fact rather than dedicated detection of the technique itself.
T1556.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant PAM modifications as policy violations, but this is limited to post-modification discovery within scheduled or scoped reviews rather than real-time detection of the technique itself.
T1556.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with password/encryption policies, which would detect the reversible-encryption setting when it deviates from the defined baseline; it does not instrument runtime adversary use of the decrypted credentials.
T1556.006detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with MFA-related policies or configurations, which would detect many instances of the technique after it has run.
T1556.007detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards; hybrid-identity backdooring (DLL injection, config tampering, rogue PTA registration) would typically violate authentication, configuration, and change-management rules and can therefore be discovered during such reviews, but the clause's governance-oriented mechanism reaches only a minority slice of the technique's stealthy on-prem/cloud execution paths.
T1556.008detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant Registry entries, DLLs or logon behaviors matching the technique, but the clause is silent on credential-theft specifics, real-time detection, or coverage of all deployment points such as domain controllers.
T1556.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies and standards; conditional-access policies are such a standard, so violations can be found, but the clause is silent on real-time detection of the adversarial modification technique itself and the reviews are periodic rather than continuous.
T1557.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as disabling LLMNR/NBT-NS/mDNS or requiring secure alternatives, thereby detecting the technique when it violates those rules; this is only a slice because the control is governance-oriented, does not mandate specific detection mechanisms for the network behavior itself, and many implementations would miss it.
T1558.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can discover golden-ticket enabling conditions such as KRBTGT hash exposure or missing privileged-access controls, but does not instrument for the technique's runtime indicators or forged-ticket artifacts themselves.
T1561recovers — A.5.36 requires identifying non-compliance, evaluating/implementing/reviewing corrective actions (including timely ones) and recording results; this can include post-wipe recovery actions to restore availability, but the clause itself only governs the compliance-review-and-correct process rather than mandating or performing the actual recovery mechanisms (e.g. backups or restores).
T1561.001recovers — A.5.36 requires identifying non-compliance (including with backup/recovery rules per 5.1/8.13), evaluating/implementing/reviewing corrective actions that can include data restoration from backups after a wipe, and timely completion; this recovers state post-T1561.001 but leaves a named remainder for data written since last backup or untested recovery processes.
T1561.002recovers — A.5.36 requires identifying non-compliance (including availability-impacting events like disk-structure wipe), evaluating/implementing/reviewing corrective actions to restore compliance, and timely completion; this directly maps to recovering from the realized technique's impact on system boot/availability, with the named remainder being the window until the next scheduled review or incomplete actions.
T1563.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on session security, RDP hardening, or privilege use, thereby detecting the technique when it violates those rules; this is limited to policy-violation detection rather than direct RDP hijacking telemetry.
T1564.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration or malware prevention, which would include detecting resource-fork abuse on macOS when such use violates those policies; it is not a dedicated detection mechanism for the technique itself and depends on what the organization chose to require and review.
T1565detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security requirements; data manipulation that violates integrity-related rules can be discovered during those reviews, but the clause is scoped only to policy-compliance checks rather than real-time or comprehensive detection of the technique itself.
T1565.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security requirements; this can detect post-incident integrity violations or anomalous stored-data states if they violate policy, but does not mandate or focus on real-time detection of the T1565.001 technique itself.
T1565.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with integrity-related policies/standards, which would detect some instances of transmitted data manipulation after the fact; this is only a slice because the control is governance-oriented, depends on what the organization chooses to measure, and does not mandate specific detection of in-transit alterations.
T1567.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as data handling or exfiltration rules, thereby detecting the technique when it violates those policies; extent is partial because the control is governance-oriented, depends on what policies/tools are chosen, and does not mandate specific detection of code-repository exfiltration itself.
T1567.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant configurations or behaviors enabling webhook exfiltration, but does not mandate detection of the technique in flight or of the exfiltration event itself.
T1568.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configurations, DNS practices or C2 indicators, but does not mandate or guarantee detection of the live Fast Flux technique itself.
T1569detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure service configuration and use, which would detect some T1569 abuse after the fact; this is only a slice because the clause is governance-oriented, does not mandate specific service telemetry or real-time detection, and many abuse instances (especially one-off or remote) fall outside routine compliance checks.
T1569.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant use of systemctl for service execution, but this is governance-driven and scope-dependent rather than continuous behavioral detection of the technique itself.
T1571detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration and network controls, which would detect some non-standard port usage when it violates an explicit rule, but the control is governance-oriented and does not mandate or perform detection of the technique itself.
T1574.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies on secure configuration, development, and operations, which would include detecting many DLL sideloading/hijacking patterns if they violate those policies; however, it is governance-oriented, depends on what the org actually measures, and does not inherently instrument or detect the runtime technique itself.
T1574.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with permission-setting rules or standards, which would detect many instances of this installer weakness after it is introduced but before or during exploitation; it is not required to instrument runtime detection of the hijacking technique itself.
T1574.008detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies requiring full-path usage or secure search-order practices, but does not mandate instrumentation that would reliably catch in-flight hijacking of a vulnerable program.
T1574.009detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant configurations such as unquoted paths in services/shortcuts, which is exactly the vulnerable state enabling T1574.009; it is not guaranteed to catch every instance or every runtime execution of the technique.
T1574.010detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with permission-related rules/standards, which would detect the underlying weakness enabling T1574.010; extent is partial because the clause is governance-oriented, depends on what the organization chooses to measure, and does not mandate detection of the technique in flight or post-exploitation.
T1578detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards; this can detect post-modification deviations or unauthorized infrastructure changes when they violate defined rules, but the clause is governance-oriented, not a technical detection mechanism, and only catches what the organization's specific policies choose to measure.
T1578.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies such as backup, logging, or instance-lifecycle rules whose violation would indicate T1578.003; this is genuine but only a minority slice of the technique because most deletion events are not policy violations and the clause stops at review rather than mandating detection instrumentation.
T1578.003responds — A.5.36 requires identifying non-compliance (including via automated tools), determining causes, implementing corrective actions, verifying effectiveness, recording results, and timely completion — which directly maps to containment/eradication response once the deletion technique has run and left detectable non-compliance or evidence gaps on IaaS platforms.
T1578.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards, which can detect post-facto reversion of a cloud instance as anomalous non-compliant configuration or evidence removal, but only where such reversion violates a defined policy and the review scope includes it.
T1578.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with policies/standards, which can detect unauthorized modifications to cloud compute configs as policy violations; partial because the clause is governance-oriented, depends on what the org defines as compliant, and does not mandate specific detection of the technique itself.
T1602.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with configuration-related policies/standards, which would include unauthorized access or export of network device configs; this is a genuine but minority slice of the technique (post-facto compliance review vs. real-time detection of the access itself).
T1612detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with policies/standards on secure container build practices, thereby detecting the technique when it violates those rules; this is only a slice because the control is governance-oriented, depends on what the org actually defines/enforces in its standards, and does not mandate specific technical detection of image builds.
T1621detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with MFA-related policies or standards, which can detect repeated login attempts or anomalous MFA request patterns if those are codified as review criteria; this is only a slice because the clause is governance-oriented, does not mandate specific detection instrumentation or real-time monitoring of the technique itself, and depends on what the organization chooses to review.
T1671detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliant OAuth integrations as policy violations, but the clause is silent on real-time detection of the technique itself and the review scope is set by the organization, leaving many stealthy or consented integrations outside what is examined.
T1677detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards; pipeline poisoning that violates those policies can be discovered during such reviews, but the clause is silent on real-time or build-specific detection and the bulk of T1677 execution paths sit outside routine compliance checks.
T1679detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with security policies/standards, which may include detecting anomalous selective-exclusion behavior if it violates an implemented policy or leaves detectable indicators; this is only a slice because the control is governance-oriented, depends on what the organization chose to baseline, and does not mandate specific detection of the technique itself.
T1685detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards, which would include instances of tools being disabled or tampered with; this is genuine but only a slice because the clause is governance-oriented, depends on what the organization chooses to measure, and does not mandate continuous or broad telemetry-based detection of the live technique itself.
T1685responds — A.5.36 requires managers to detect non-compliance via reviews (including of security tools and mechanisms), identify causes, implement corrective actions, verify effectiveness, record results, and ensure timely remediation — directly addressing an in-flight or realized T1685 instance by containing/eradicating the tampering and restoring defensive capability.
T1685.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with information security requirements such as mandated logging/audit policies; this can discover the T1685.001 modifications after they occur, but the clause's governance-oriented mechanism (policy compliance checks) reaches only a slice of the technique's possible artifacts rather than the bulk with a bounded remainder.
T1685.001responds — A.5.36 requires managers to review for non-compliance (including with logging/audit policies), identify causes, implement and verify corrective actions such as re-enabling the EventLog service or restoring auditpol settings once the technique has run, which matches the `responds` verb; extent is partial because the clause is governance-oriented, scoped to scheduled or independent reviews rather than real-time containment/eradication of an in-progress disablement.
T1685.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with logging-related policies/standards, which would detect many instances of disabled/modified cloud logging after the fact; it is not a real-time detection mechanism and does not cover all adversary modifications outside explicit policy checks.
T1685.002responds — A.5.36 requires identifying non-compliance (including disabled/modified logging), evaluating and implementing corrective actions to restore compliance, and verifying effectiveness, which responds to the realized technique by containing/eradication once underway, but only after detection via review and with a named remainder for cases not caught until the next scheduled review.
T1685.004detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security rules/standards such as audit configuration; this can detect post-facto tampering with auditd/rules but does not instrument real-time detection of the technique itself.
T1685.005detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance such as cleared event logs when those logs are required by policy, but the clause is silent on real-time detection of the technique itself and the review scope is set by the organization rather than mandating coverage of this specific action.
T1685.005responds — A.5.36 requires managers to identify non-compliance (including via automatic tools that can surface log-clearing), then contain/eradicate by identifying causes, implementing corrective actions such as restoring logs or re-enabling logging, and verifying effectiveness — which matches the `responds` definition of acting on an event once underway.
T1685.006responds — A.5.36 requires identifying non-compliance (including log-clearing as policy violation), evaluating/implementing/reviewing corrective actions, and recording/reporting them; this matches the `responds` verb (containment/eradication once the technique is underway) but only for the subset of cases surfaced by the mandated reviews rather than all intrusions.
T1686detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with firewall-related rules or standards, but this is limited to scheduled or periodic compliance checks rather than real-time detection of in-progress adversarial tampering.
T1686responds — A.5.36 requires identifying non-compliance (including with firewall-related rules), evaluating/implementing/reviewing corrective actions to restore compliance, and recording/reporting results, which responds to the realized technique once detected by containing its effects and restoring defensive posture.
T1686.001detects — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/rules/standards, which can discover unauthorized firewall modifications as policy violations; however, this is governance-oriented review after the fact rather than real-time detection of the technique itself, and depends on what the organization defines as a review target.
T1686.002detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with firewall-related rules/standards, plus recording and independent review of findings; this detects the post-breach configuration change in some cases but is not scoped to real-time technique observation and leaves many in-flight or un-reviewed device changes unseen.
T1686.003detects — A.5.36 requires reviews (including automated measurement/reporting tools) that can surface non-compliance with firewall-related rules and standards, plus recording/reporting of findings; this surfaces the technique after it runs but only where the review scope and cadence actually cover host firewall state, which is not required by the clause.

Prevented OWASP Web Top 10 (2025) risks (12)

OWASP Web Top 10 (2025) risk categories this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

A01←P →P A02→P A06←P A08→P A09→P A10←P →P

Why these map — AI rationale (under review)

A01finds — A.5.36 explicitly requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards, which would discover many Broken Access Control violations when those policies mandate proper authorization enforcement.
A02finds — A.5.36 explicitly requires reviews (including automated measurement/reporting tools) that discover non-compliance with security policies/standards, which directly surfaces weak defaults, incomplete hardening and exposed settings that constitute the A02 misconfiguration class.
A02mitigates — A.5.36's review-and-correct mechanism surfaces and drives remediation of misconfigurations that violate policy, thereby bounding realized impact until fixed, but does not itself alter the weak defaults or exposed surface that constitute the weakness.
A02remediates — A.5.36 requires identifying non-compliance (including misconfigurations against policy/standards), then evaluating/implementing/reviewing corrective actions that remove the insecure defaults or exposed settings; this directly remediates instances of the weakness, but only for those surfaced by the organization's chosen review process rather than all instances or root causes like missing automation.
A08finds — A.5.36 explicitly requires reviews (including automated measurement/reporting tools) that discover non-compliance with information security policies/standards, which surfaces many integrity failures (e.g. unsigned updates or missing verification) when they violate applicable rules; it does not address all members such as certain CI/CD pipeline compromises or deserialization flaws that may not be caught by policy-compliance reviews.
A09finds — A.5.36 requires reviews (including automated measurement/reporting tools) that surface non-compliance with any security requirements, which would discover missing or ineffective logging/alerting when those are mandated by policy or standards; it is not specific to this weakness and the clause's primary focus is compliance verification rather than incident detection.
A10finds — A.5.36 explicitly requires reviews (including automated measurement/reporting tools) that surface non-compliance with security policies/standards, which would discover mishandled exceptions that violate those policies; however, it is governance-oriented and does not itself perform technical discovery of the code-level defects in the OWASP class.

Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.