Who We Are
About The Standard Domain
ISAUnited is a Standards Development Organization focused on developing, governing, publishing, and maintaining cybersecurity standards for architecture, engineering, verification, validation, and evidence-based implementation.
Our work supports practitioners and organizations that need cybersecurity expectations translated into measurable technical outcomes that can be implemented, reviewed, validated, and defended with proof.
What We Develop
Standards Built for Architecture, Engineering, and Proof
The Defensible 10 Standards provide a structured standards foundation for designing, building, testing, and proving secure systems across ten cybersecurity domains.
Each standard is designed to help practitioners move from security intent to engineered outcomes through:
Requirements
Defines the measurable outcomes each domain must achieve.
Technical Specifications
Translates requirements into architecture and engineering expectations.
Verification and Validation
Defines how implementation and effectiveness are tested.
Implementation Guidance
Supports traceability, audit readiness, and defensible proof.
Why the Standards Matter
Moving Cybersecurity from Intent to Engineered Outcomes
Many cybersecurity programs rely on policies, frameworks, tools, and control checklists, but still lack a practical standards model for engineering secure systems.
ISAUnited helps close that gap by defining standards that support secure design, disciplined implementation, measurable validation, and evidence-backed assurance.
Design with Clarity
Establish clear cybersecurity architecture and engineering expectations.
Build with Discipline
Translate expectations into repeatable implementation practices.
Prove with Evidence
Validate outcomes and produce defensible proof that security works.
The Defensible 10 Model
In 2023, a small group of cybersecurity architects and engineers convened for a workshop with a narrow goal: study the last decade of major cyber incidents, focusing on intrusions and data leaks, and treat them as engineering failures rather than isolated events.
We approached the review the way engineers investigate disasters. We did not start with tools, vendors, or media narratives. We began with sequences: what was assumed, what was built, what changed, what was observed, what actions were possible under pressure, and what proof existed after the fact. Across industries and architectures, the same failure patterns kept resurfacing.
6 patterns repeated with uncomfortable consistency. Teams could not clearly define their scope and exposure. Security intent was not translated into explicit design decisions. Change moved into production without disciplined control. Telemetry was incomplete, delayed, or untrusted. Containment was slow, manual, or improvised. Finally, teams could not demonstrate that defenses were working, leaving leadership and practitioners relying on confidence rather than evidence.
We captured those patterns, named them, and reverse-engineered them into 6 defensible elements. We then organized them into a repeatable engineering loop that drives work from definition through demonstration. The loop is intentionally simple because it must be executed under real operational conditions, not only during audits or major incidents. The end state is not a claim of security. The end state is evidence.
That loop became the 6 Defensible Loop model. The Defensible 10 Standards became the coverage. We mapped the enterprise security surface to 10 cybersecurity domains and required the same 6 Defensible Loop (D-Loop) to be executed within each domain standard. Each standard runs the loop. Each standard ends in proof via evidence.
Download Access Note
If your organization blocks file downloads, please contact us via the website or by email at info@isaunited.org.