TIM-5030 v4

Carnegie Mellon University. (2016). Vulnerability management. Cybersecurity & Infrastructure Security Agency, Cyber Resilience Review.
This document is important because it provides a good overview of the creation and administration of a vulnerability management program.

Strom, B. (2018, September). ATT&CK 101. MITRE Corporation.
This blog post is important because it provides the reader with an overview and rationale behind the MITRE ATT&CK framework. This cyber attacker framework is used by most Fortune 500 organizations to map attacker activities to defensive capabilities.

MITRE Corporation. (n.d.). ATT&CK Groups.
This website provides in-depth information on well-known cyber-attack groups

Kwon, R., Ashley, T., Castleberry, J., Mckenzie, P., & Gupta Gourisetti, S. N. (2020). Cyber Threat Dictionary Using MITRE ATT&CK Matrix and NIST Cybersecurity Framework Mapping. 2020 Resilience Week (RWS), Resilience Week (RWS), 2020, 106–112. https://doi.org/10.1109/RWS50334.2020.9241271
This document is useful because it links MITRE's ATT&CK framework with the NIST CSF. Companies struggle to link frameworks together like this, but it's very useful when you have a map.

Bodeau, D., McCollum, C. & Fox, D. (2018, April). Cyber threat modeling: Survey, assessment, and representative framework. Homeland Security Systems Engineering and Development Institute (HSSEDI). MITRE.
This document is important because it provides an overview of cyber threat modeling frameworks. Organizations can use these threat modeling frameworks to facilitate developing controls to mitigate the risk of cyber threats.