Bow Tie Kreative SECURITY Grammar
API reference

The program

Adopted standards

10 standards anchor the grammar — NIST CSF and SP 800-61/800-115, OWASP ASVS and WSTG, CVSS, EPSS, the CISA KEV catalog, MITRE ATT&CK and D3FEND — each pinned to an adopted version as of 2026-09-03, reviewed quarterly and on upstream release.

This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

The register

IDAdopted versionPurpose
NIST-CSF 2.0 program outcomes across Govern, Identify, Protect, Detect, Respond, and Recover
NIST-SP-800-61 Revision 3 incident preparation, response, and recovery integration
NIST-SP-800-115 final technical security testing and assessment governance
OWASP-ASVS 5.0.0 web application security requirements and verification objectives
OWASP-WSTG 4.2 stable web application test-method references
FIRST-CVSS 4.0 vulnerability severity characteristics and vector
FIRST-EPSS current-daily-model-output separate 30-day exploitation probability signal
CISA-KEV current-catalog-snapshot known exploitation signal
MITRE-ATTACK pin-snapshot-in-production adversary behavior vocabulary
MITRE-D3FEND pin-snapshot-in-production defensive countermeasure knowledge graph

Version rules

  • Store exact framework and tool versions with profiles, tests, findings, and evidence.
  • Preserve historical mappings when upgrading standards.
  • Test parser and rule changes before accepting a new upstream version.
  • Never reinterpret old evidence using a newer profile without recording the transformation.

The chapter in full

13. Standards and upstream references

These are the primary sources used to shape the grammar. Pin adopted versions in production policy and review them periodically.

Program and incident framework

  • NIST Cybersecurity Framework 2.0: https://www.nist.gov/cyberframework
  • NIST CSF 2.0 functions and updates: https://www.nist.gov/cyberframework/updates-archive
  • NIST SP 800-53 controls and machine-readable downloads: https://csrc.nist.gov/projects/risk-management/sp800-53-controls
  • NIST SP 800-115, Technical Guide to Information Security Testing and Assessment: https://csrc.nist.gov/pubs/sp/800/115/final
  • NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations: https://csrc.nist.gov/pubs/sp/800/61/r3/final
  • CISA Secure by Design: https://www.cisa.gov/securebydesign

Web application security

  • OWASP Application Security Verification Standard: https://owasp.org/www-project-application-security-verification-standard/
  • OWASP Web Security Testing Guide stable: https://owasp.org/www-project-web-security-testing-guide/v42/
  • OWASP Web Security Testing Guide latest contributions: https://owasp.org/www-project-web-security-testing-guide/latest/
  • OWASP Top 10: https://owasp.org/www-project-top-ten/
  • OWASP ZAP Baseline Scan: https://www.zaproxy.org/docs/docker/baseline-scan/
  • OWASP ZAP Full Scan safety distinction: https://www.zaproxy.org/docs/docker/full-scan/

Linux, storage, and containers

  • Ubuntu Security Guide: https://documentation.ubuntu.com/security/compliance/usg/
  • Ubuntu security feature overview: https://documentation.ubuntu.com/security/security-features/security-features-overview/
  • Ubuntu Secure Boot: https://documentation.ubuntu.com/security/security-features/platform-protections/secure-boot/
  • cryptsetup/LUKS manual: https://man7.org/linux/man-pages/man8/cryptsetup.8.html
  • Docker Engine security: https://docs.docker.com/engine/security/
  • Docker Rootless mode: https://docs.docker.com/engine/security/rootless/
  • Docker seccomp: https://docs.docker.com/engine/security/seccomp/
  • Docker AppArmor: https://docs.docker.com/engine/security/apparmor/
  • Ansible playbooks: https://docs.ansible.com/projects/ansible/latest/playbook_guide/playbooks_intro.html

Vulnerability prioritization

  • FIRST CVSS v4.0: https://www.first.org/cvss/v4.0/
  • FIRST CVSS v4.0 specification: https://www.first.org/cvss/specification-document
  • FIRST EPSS: https://www.first.org/epss/
  • FIRST guidance on using EPSS: https://www.first.org/epss/using-epss
  • CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Scanning and monitoring tools

  • Trivy: https://trivy.dev/
  • Trivy filesystem scanning: https://trivy.dev/docs/latest/target/filesystem/
  • Trivy image scanning: https://trivy.dev/docs/latest/target/container_image/
  • Trivy misconfiguration scanning: https://trivy.dev/docs/latest/guide/scanner/misconfiguration/
  • Wazuh file-integrity monitoring: https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html
  • Wazuh vulnerability detection: https://documentation.wazuh.com/current/user-manual/capabilities/vulnerability-detection/how-it-works.html

Versioning rule

Store the adopted standard/tool version with every profile and evidence artifact. “Latest” is not a reproducible version. Update deliberately, test parser/profile changes, and retain historical mappings so old findings remain understandable.

The standards register as JSON →