According to CrowdStrike Global Threat Report 2025, the average time of horizontal movement of the attacker after primary access is 62 minutes. The record is 51 seconds. At the gap-analysis of last year, I looked at the company’s infrastructure with the current ISO 27001 certificate and saw a familiar picture: control A.8.16 (Monitoring activities) formally existed, SIEM chewed Windows Security Logs, but not a single rule of correlation under the techniques of lateral movement – T1021 Remote Services, T1550 Use Alternate Authentication Material - it wasn't. For three days the attacker walked on the network. Zero Alerts. The certificate hung on the wall, the auditor put a tick opposite A.8.16 six months before the incident.
Why ISO 27001 Annex A Controls Do Not Stop the Elemental Movement
ISO 27001:2022 describes 93 controls in Annex A. Everyone formulates a requirement at the level "what should be done?" - protection of authentication, journaling, monitoring activity. No control explains what specific behavior of the attacker needs to be detected. The standard operates at the governance level: sharing of responsibilities, cybersecurity risk management, process management of ISMS. It's his architectural task - and he solves it.
MITRE ATT&CK solves the opposite problem: it systematizes specific tactics, techniques and procedures (TPs) of real attackers. The MITRE ATT&CK matrix will not say who is responsible for patch management, but it will show that Valid Accounts (T1078, Initial Access, Persistence, Privilege Escalation, Defense Evasion) is used for consolidation through compromised legitimate accounts.
To contrast these frameworks is a methodological error (and Habra rightly wrote about it). They work at different levels of security architecture. The problem is the other: without the operating mapping between them, the control of the Annex A is covered on paper, and between them there are voids through which the attacker passes.
Compromised accounts: failure of formal controls
The IBM X-Force Thread Intelligence Index 2025 records an increase in attacks using valid account data by 71% year-on-year. According to Verizon DBIR 2025, 38% of leaks are related to thefts of credentials. Control A.8.5 (Secure authentication) of ISO 27001:2022 requires secure authentication mechanisms: MFA, password policies, session management. Formally it covers T1078 Valid Accounts. In practice, no.
T1078 covers the scripts that A.8.5 does not address directly:
Using stolen OAuth tokens without a password
Authorization through data collected by infostealers (according to IBM, infostealers - 32% of the total malware in 2024)
Compromise service with accounts of perpetual passwords
Insider threat: a legitimate employee acting outside the framework of baseline behavior
Compromised hosts looking clean for endpoint protection
The ISO 27001 auditor will check that the MFA is on and the password policy complies with A.8.5. The auditor will not check whether SIEM detects abnormal logging or the activity of service account during non-working hours. Here is the gap between governance and operational security.
The financial context makes this gap painful. Russian legislation has introduced negotiable fines for the leakage of personal data. The ISO 27001 certificate will not save if the incident occurred due to the lack of operational detection of TTPs. Formal audit checklist and infrastructure protection through threat-informed defense are different things.
ATT&C mapping Security Controls ISO 27001: Covering Table
According to Mandiant M-Trends 2025, exploits - 38% of all channel access vectors. Control A.8.8. sets the vulnerability management process, but does not define SLA at a critical CVE patch. And IBM X-Force fixes the average time between the publication of CVE and the elimination of 29 months in the organization. Mapping shows a gap: the information security standard says “gover vulnerabilities” and ATT&CK shows that T1190 Exploited in days.
The attack chain through the prism of the mapping
Let’s look at the type of kill chain and see where each ISO 27001 control rises – and where it breaks down.
Initial Access - T1566 Phishing (Initial Access): letter with ISO-investment. Control A.8.7 detects known signatures. Sigma-rule win_security_iso_mount.yml (one of the 36 rules tagged T1566 in SigmaHQ, including deprecated and cross-platform) catches the mounting of ISO files, but it needs to be imported into SIEM. A.8.7 does not require that. According to the Verizon DBIR 2025, phishing remains a vector of initial access in 36% of incidents.
Execution - T1059 Command and Scripting Interpreter (Execution): PowerShell launch. Control A.8.15 records the event only when the extended journaling is included (Module Logging, Script Block Logging). Without them, there is a blind spot. In SigmaHQ for T1059 397 rules available, including proc_creation_win_powershell_dsinternals_cmdlets.yml.
Credential Access - T1110 Brute Force or T1552 Unsecured Credentials: extracting account data from configuration files, scripts, environment variables. Control A.8.5 limits input attempts, but does not detect the extraction of credentials.
Lateral Movement - T1021 Remote Services (Lateral Movement): Move through RDP/SMB. Control A.8.16 requires monitoring, but without baseline - what to consider a normal RDP-session - any detection sinks in the noise.
Command and Control - T1071 Application Layer Protocol: C2 via HTTPS. Control A.8.20 describes network segmentation, but does not require an analysis of encrypted traffic or JA3/JA4-fingerprinting.
Each control of Annex A covers one slice. ATT&C mapping security controls reveals voids between these slices.
Gap-analysis of coating via ATT&CK Navigator
ATT&C Navigator is a free MITRE tool for visualizing the attack techniques. Here is the process of gap-analysis, which I use on real audits:
Step 1. Create a layer (layer) with techniques formally covered with ISO 27001 Annex A control. Marking the green. For mapping, use the table above - or an extended version from the MITRE CTID (Center for Threat-Informed Defense project), where the mapping NIST SP 800-53 -> ATT&CK (center-for-threat-informed-defense/attack-control-computer-mappings) ISO 27001 will require an intermediate compliance table of ISO 27001:2022 <-> NIST 800-53, which gives a transitive mapping ISO -> 800-53 -> ATT&CK.
Step 2. Create a second layer with techniques for which SIEM has a functioning correlation rules. Mark it blue.
Step 3. Relying layers. Green cells without blue - ISO 27001 control exists, there is no detection. These are priorities for SOC.
At the first overlap, a typical organization with ISO 27001 shows coverage of the correlation rules of 15-25% of the claimed coverage of the control of Annex A (for my experience, gap analysis). The remaining 75-85% - management on paper without surgical detection of attacks.
Pentest as Mapping Validation
ISO 27001 pentest is the usual part of the audit cycle. Problem: Pentest results rarely punch on specific ATT&C technicians. The pentester found a SQL injection - the report contains CVSS and a recommendation, but not a binding to the Exploit Public-Facting Application (T1190, Initial Access) and not checking whether the correlation rule in SIEM worked.
Threat-informed defense begins when the results of the pentest are used to validate the mapping:
Pentester operates T1190 - SOC must fix the alter
Pentester performs T1059 (Command and Scripting Interpreter) - SIEM should raise the event
Pentester moves through T1021 Remote Services (RDP/SMB) - baseline lateral movement should work
If there is no alerta, the gap is confirmed. If there is an altrate, fixed as evidence for the auditor according to A.8.16 and A.5.7.
D3FEND (knowledge graph of MITRE protective techniques) helps to identify specific countermeasures:
T1078 : D3-LAM (Local Account Monitoring) and D3-DAM (Domain Account Monitoring)
T1190 : D3-PMAD (Protocol Metadata Anomaly Detection) and D3-CSPP (Client-server Payload Profiling)
T1059 : D3-DA (Dynamic Analysis) and D3-EFA (Emulated File Analysis)
Each D3FEND countermeasure is translated into a specific SOC task: configure the rule, enable the telemetry source, add enrichment.
Why ISO 27001 Annex A Controls Do Not Stop the Elemental Movement
ISO 27001:2022 describes 93 controls in Annex A. Everyone formulates a requirement at the level "what should be done?" - protection of authentication, journaling, monitoring activity. No control explains what specific behavior of the attacker needs to be detected. The standard operates at the governance level: sharing of responsibilities, cybersecurity risk management, process management of ISMS. It's his architectural task - and he solves it.
MITRE ATT&CK solves the opposite problem: it systematizes specific tactics, techniques and procedures (TPs) of real attackers. The MITRE ATT&CK matrix will not say who is responsible for patch management, but it will show that Valid Accounts (T1078, Initial Access, Persistence, Privilege Escalation, Defense Evasion) is used for consolidation through compromised legitimate accounts.
To contrast these frameworks is a methodological error (and Habra rightly wrote about it). They work at different levels of security architecture. The problem is the other: without the operating mapping between them, the control of the Annex A is covered on paper, and between them there are voids through which the attacker passes.
Compromised accounts: failure of formal controls
The IBM X-Force Thread Intelligence Index 2025 records an increase in attacks using valid account data by 71% year-on-year. According to Verizon DBIR 2025, 38% of leaks are related to thefts of credentials. Control A.8.5 (Secure authentication) of ISO 27001:2022 requires secure authentication mechanisms: MFA, password policies, session management. Formally it covers T1078 Valid Accounts. In practice, no.
T1078 covers the scripts that A.8.5 does not address directly:
Using stolen OAuth tokens without a password
Authorization through data collected by infostealers (according to IBM, infostealers - 32% of the total malware in 2024)
Compromise service with accounts of perpetual passwords
Insider threat: a legitimate employee acting outside the framework of baseline behavior
Compromised hosts looking clean for endpoint protection
The ISO 27001 auditor will check that the MFA is on and the password policy complies with A.8.5. The auditor will not check whether SIEM detects abnormal logging or the activity of service account during non-working hours. Here is the gap between governance and operational security.
The financial context makes this gap painful. Russian legislation has introduced negotiable fines for the leakage of personal data. The ISO 27001 certificate will not save if the incident occurred due to the lack of operational detection of TTPs. Formal audit checklist and infrastructure protection through threat-informed defense are different things.
ATT&C mapping Security Controls ISO 27001: Covering Table
According to Mandiant M-Trends 2025, exploits - 38% of all channel access vectors. Control A.8.8. sets the vulnerability management process, but does not define SLA at a critical CVE patch. And IBM X-Force fixes the average time between the publication of CVE and the elimination of 29 months in the organization. Mapping shows a gap: the information security standard says “gover vulnerabilities” and ATT&CK shows that T1190 Exploited in days.
The attack chain through the prism of the mapping
Let’s look at the type of kill chain and see where each ISO 27001 control rises – and where it breaks down.
Initial Access - T1566 Phishing (Initial Access): letter with ISO-investment. Control A.8.7 detects known signatures. Sigma-rule win_security_iso_mount.yml (one of the 36 rules tagged T1566 in SigmaHQ, including deprecated and cross-platform) catches the mounting of ISO files, but it needs to be imported into SIEM. A.8.7 does not require that. According to the Verizon DBIR 2025, phishing remains a vector of initial access in 36% of incidents.
Execution - T1059 Command and Scripting Interpreter (Execution): PowerShell launch. Control A.8.15 records the event only when the extended journaling is included (Module Logging, Script Block Logging). Without them, there is a blind spot. In SigmaHQ for T1059 397 rules available, including proc_creation_win_powershell_dsinternals_cmdlets.yml.
Credential Access - T1110 Brute Force or T1552 Unsecured Credentials: extracting account data from configuration files, scripts, environment variables. Control A.8.5 limits input attempts, but does not detect the extraction of credentials.
Lateral Movement - T1021 Remote Services (Lateral Movement): Move through RDP/SMB. Control A.8.16 requires monitoring, but without baseline - what to consider a normal RDP-session - any detection sinks in the noise.
Command and Control - T1071 Application Layer Protocol: C2 via HTTPS. Control A.8.20 describes network segmentation, but does not require an analysis of encrypted traffic or JA3/JA4-fingerprinting.
Each control of Annex A covers one slice. ATT&C mapping security controls reveals voids between these slices.
Gap-analysis of coating via ATT&CK Navigator
ATT&C Navigator is a free MITRE tool for visualizing the attack techniques. Here is the process of gap-analysis, which I use on real audits:
Step 1. Create a layer (layer) with techniques formally covered with ISO 27001 Annex A control. Marking the green. For mapping, use the table above - or an extended version from the MITRE CTID (Center for Threat-Informed Defense project), where the mapping NIST SP 800-53 -> ATT&CK (center-for-threat-informed-defense/attack-control-computer-mappings) ISO 27001 will require an intermediate compliance table of ISO 27001:2022 <-> NIST 800-53, which gives a transitive mapping ISO -> 800-53 -> ATT&CK.
Step 2. Create a second layer with techniques for which SIEM has a functioning correlation rules. Mark it blue.
Step 3. Relying layers. Green cells without blue - ISO 27001 control exists, there is no detection. These are priorities for SOC.
At the first overlap, a typical organization with ISO 27001 shows coverage of the correlation rules of 15-25% of the claimed coverage of the control of Annex A (for my experience, gap analysis). The remaining 75-85% - management on paper without surgical detection of attacks.
Pentest as Mapping Validation
ISO 27001 pentest is the usual part of the audit cycle. Problem: Pentest results rarely punch on specific ATT&C technicians. The pentester found a SQL injection - the report contains CVSS and a recommendation, but not a binding to the Exploit Public-Facting Application (T1190, Initial Access) and not checking whether the correlation rule in SIEM worked.
Threat-informed defense begins when the results of the pentest are used to validate the mapping:
Pentester operates T1190 - SOC must fix the alter
Pentester performs T1059 (Command and Scripting Interpreter) - SIEM should raise the event
Pentester moves through T1021 Remote Services (RDP/SMB) - baseline lateral movement should work
If there is no alerta, the gap is confirmed. If there is an altrate, fixed as evidence for the auditor according to A.8.16 and A.5.7.
D3FEND (knowledge graph of MITRE protective techniques) helps to identify specific countermeasures:
T1078 : D3-LAM (Local Account Monitoring) and D3-DAM (Domain Account Monitoring)
T1190 : D3-PMAD (Protocol Metadata Anomaly Detection) and D3-CSPP (Client-server Payload Profiling)
T1059 : D3-DA (Dynamic Analysis) and D3-EFA (Emulated File Analysis)
Each D3FEND countermeasure is translated into a specific SOC task: configure the rule, enable the telemetry source, add enrichment.
