Attack Vector
What is Attack Vector?
The method or pathway used by a threat actor to gain unauthorised access to a target system. Common attack vectors include phishing emails, unpatched software vulnerabilities, and compromised credentials.
Frameworks that govern attack vector
What the standards actually require on attack vector
Requirements naming attack vector across 6 standards, quoted from the control text.
Where the attack-vector-based method is chosen, the rating should come from assessing which attack vector dominates the attack path (Annex G.4); this method fits early phases, before the specific paths are known.
iso-sae-21434::RC-15-14 · [RC-15-14] Attack-vector-based approach →Where several configuration settings are needed to comply with a single SRG requirement the author inserts additional rows by duplicating the requirement's row and updating the specific content, each new row keeping the original IA control, CCI, SRG ID, SRG re...
disa-security-technical-implementation-guides-stigs::REQ-11 · REQ-11 Additional rows: one row per setting or attack vector, and CCI-000366 for best practice →Notify the E-ISAC and, for entities under United States jurisdiction, the National Cybersecurity and Communications Integration Center (NCCIC, now within CISA) or its successor, of Reportable Cyber Security Incidents and attempts to compromise, unless prohibit...
nerc-cip::CIP-008 R4.1 · CIP-008-6 R4.1: Notification content: functional impact, attack vector, level of intrusion →CSF 2.0 outcome: threats, vulnerabilities, likelihoods and impacts are used to understand inherent risk and inform risk response prioritization. Priority High.
nist-sp-800-61-rev-3::ID.RA-05 · ID.RA-05 Existing risk estimation mechanisms used for incident response →The plan must require a catalogue of the threats identified against IAC segregated environments with consistent criteria for identifying them and for assessing and categorising them (type, credibility);
api-1164::ID.RA-3 · ID.RA-3 Threat catalogue with consistent identification and categorisation by vector and actor →For each threat condition the applicant identifies the threat scenarios that could lead to it: the threat source (attacker and attack vector), the vulnerabilities exploited, the operational conditions, the events by which the target is attacked and the threat...
do-326a-ed-202a::3.2.2 · Threat scenario identification →Questions people ask about attack vector
What is Attack Vector?
Why is Attack Vector important for compliance?
Which compliance frameworks address Attack Vector?
Where can I learn more about Attack Vector?
See how Attack Vector applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.