Defence in Depth
What is Defence in Depth?
A security strategy that uses multiple layers of controls to protect assets. If one layer fails, others continue to provide protection.
Terms that appear alongside defence in depth
Each of these is named in at least one of the same controls as defence in depth. The number is how many controls name both.
- security architecture 5 shared controls
- integrity 2 shared controls
- resilience 2 shared controls
- owasp 2 shared controls
- security controls 2 shared controls
- iec 62443 2 shared controls
- dmz 2 shared controls
- isolation 2 shared controls
Frameworks that govern defence in depth
What the standards actually require on defence in depth
Requirements naming defence in depth across 6 standards, quoted from the control text.
A process produces user documentation of the defence in depth measures the surrounding environment is expected to provide, such as physical arrangements, policies and procedures.
iacs-unified-requirements-e26e27-cyber-resilience-of-ships-and-on-board-systems::E27-5.6 · E27 5.6 Defence in depth measures expected in the environment (IEC 62443-4-1 SG-2) →Prepare for attacks with defence in depth combining multiple layers: perimeter network measures against intrusion, measures against misuse of systems on the internal network, and measures against data leakage to the outside.
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.3-B · 2.3 Defence in depth: basic actions →The plan must require documented physical operating environment requirements for IAC assets and systems, documentation from manufacturers, suppliers and integrators of the defence-in-depth measures the external environment must provide, design and implementati...
api-1164::PR.IP-5 · PR.IP-5 Physical operating environment requirements and defence-in-depth agreed with physical security →Apply defence in depth, stacking several security layers whose functions overlap. A small-system baseline control (Appendix K, category 6): locks, access control, unique logins, two-factor authentication, anti-malware, host and network firewalls and intrusion...
awwa-cybersecurity-guidance-for-the-water-sector-american-water-works-association::SC-16 · SC-16 Defence in depth →Protect critical systems and data with layers combining people, procedures and technology to raise detection chances, use resources well and isolate systems;
BIMCO-7.1 · Defence in depth and in breadth →NSS-17 + NSS-42-G require facility computer security architecture organised by Computer Security Zones (CSZs) implementing IAEA zone model.
IAEA-NSS17-Architecture-Zones-DefenceInDepth-Segmentation · IAEA NSS-17 - Computer Security Architecture + Zone Model + Defence in Depth + Network Segmentation + Boundary →Questions people ask about defence in depth
What is Defence in Depth?
Why is Defence in Depth important for compliance?
Which compliance frameworks address Defence in Depth?
Where can I learn more about Defence in Depth?
See how Defence in Depth applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.