Anthropic-Cybersecurity-Skills/skills/performing-cloud-incident-containment-procedures/references/standards.md

Standards for Cloud Incident Containment

NIST SP 800-61 Rev 2 - Incident Handling Guide

• Containment strategies for cloud environments
• Evidence preservation in ephemeral infrastructure

CSA Cloud Incident Response Framework

• Cloud Security Alliance incident response procedures
• Shared responsibility model for incident handling
• Multi-cloud containment strategies

AWS Well-Architected Framework - Security Pillar

• Incident response automation with AWS services
• CloudTrail, GuardDuty, and Security Hub integration
• Reference: https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/

Microsoft Cloud Security Benchmark

• Azure Defender incident response procedures
• Sentinel playbook automation
• Reference: https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-incident-response

GCP Security Best Practices

• Cloud Armor and VPC Service Controls
• Security Command Center integration
• Chronicle SIEM for cloud forensics

MITRE ATT&CK Cloud Matrix

• Cloud-specific tactics, techniques, and procedures
• Containment mapping to ATT&CK techniques
• Reference: https://attack.mitre.org/matrices/enterprise/cloud/