TIM-8355: v1

Lee, M., Kwon, H., & Yoon, H. (2022). Compliance-driven cybersecurity planning based on formalized attack patterns for instrumentation and control systems of nuclear power plants. Security & Communication Networks, 1–13.
This journal article details a case study that tests a variety of security control patterns to protect the infrastructure of a nuclear power plant needing to adhere to compliance and regulatory requirements.

Winarno, H., Yasin, F., Prasetyo, M. A., Rohdman, F., Shihab, M. R., & Ranti, B. (2020). IT infrastructure security risk assessment using the center for internet security critical security control framework: A case study at insurance company. 2020 3rd International Conference on Computer and Informatics Engineering (IC2IE), Computer and Informatics Engineering (IC2IE), 2020 3rd International Conference On, 404–409.
This journal article details research from a case study and makes recommendations to other organizations, especially insurance companies for how to improve the reliability and security of IT infrastructure through security control management.

National Institute of Standards and Technology (NIST). (2020, September). Security and privacy controls for information systems and organizations.
This web page includes new resources including a control catalog spreadsheet and mappings to various frameworks.

National Institute of Standards and Technology (NIST). (2021, December). Automated control-based assessment: Supporting control-based risk management with standardized formats.
This web page highlights a new project that is a collaborative effort between NIST and industry to develop open language machine-readable representations of control catalogs, control baselines, system security plans, and assessment plans and results.

United Nations Interregional Crime and Justice Research Institute (UNICRI) (n.d.) Threat response and risk mitigation: security governance.
This website provides information on security response to threats and the utilization of risk mitigation through security governance.

Central Intelligence Agency. (2022). The World Factbook
This website provides basic intelligence on the history, people, government, economy, energy, geography, communications, transportation, military, terrorism, and transnational issues for 266 world entities.

Hale, M. L., & Gamble, R. F. (2019). Semantic hierarchies for extracting, modeling, and connecting compliance requirements in information security control standards. Requirements Engineering, 24(3), 365–402.
This journal article presents a case study of all audit-related controls in the SP-800-53, ISO 15408-2, and related documents. The accuracy, applicability, consistency, and efficacy of the approach were evaluated using controlled qualitative and quantitative methods in two separate studies.

Preston, R., Duck., M., Finnegan, C., & Munoz, R. (2019). Integrating Cyber Security Requirements Into A Power Management System. 2019 IEEE Petroleum and Chemical Industry Committee Conference (PCIC), Petroleum and Chemical Industry Committee Conference (PCIC), 2019 IEEE, 131–138.
This journal article details a case study in the energy sector and based on the evolving cyber security threat landscape in critical infrastructure sectors, how the organization sets up cyber security programs to manage this critical infrastructure risk.

International Conference on Availability, Reliability and Security, 1–10.
This journal article details a case study in which the authors theorize about the relative effectiveness of certain risk controls on the face of threats, and provide some recommendations for strengthening the cybersecurity posture.