Lion Cipher Lab
Measure your defensive coverage: map ATT&CK techniques to NIST 800-53 controls and compute the gaps
- GRC / Compliance
- Advanced
- ~75 min
- Free · no account required
Why it matters
Most control assessments answer the wrong question. They ask 'are we compliant with the framework?' — a checklist against NIST 800-53 or ISO 27001 — and produce a green dashboard that says nothing about whether you would survive the specific ways your adversaries actually break in. A threat-informed coverage assessment flips the starting point: begin with how you get attacked (a concrete list of MITRE ATT&CK techniques for a threat you care about), find the controls that are supposed to mitigate each technique, and then measure — with a real number — how many of those techniques your…
What you'll learn
- building a threat-informed control-coverage assessment from an ATT&CK technique list
- using MITRE's published ATT&CK -> NIST 800-53 Rev 5 mappings (CTID Mappings Explorer) instead of inventing mappings
- modelling an org's control-implementation status (implemented / partial / not-implemented) as data
- writing a Python join that computes a per-technique coverage score, an overall coverage %, and a ranked gap list
- threat-weighting gaps to produce a defensible 'next remediation dollar' priority instead of chasing 100%
- articulating the coverage-is-not-effectiveness caveat and why the mapping is many-to-many and opinionated
Steps in this lab
- The pivot: measure coverage from the attacker's side, not the framework's
- Pick your threat and lock a technique list
- Pull the authoritative ATT&CK -> 800-53 mappings
- Model your organisation's control-implementation status
- Write the join: compute the coverage matrix and the overall number
- Read the result — and see why the weakest gap is not the top priority
- The judgment: coverage is not effectiveness, and the mapping is opinionated
- Write the recommendation and ship the artifact