AUDIT ← Aasfor Enquire

Security education and decision support

ISE. by Aasfor

Clear decisions. Practical security.

For leaders and teams facing a security decision, a readiness gap or a change in responsibilities. Focused advisory sessions and practical workshops turn the question into priorities, accountable actions and a written next step.

Discuss your priority See ways to work together
  • Practice-led
  • Evidence-first
  • Human-accountable
Discover ISE.
01Defined question02Agreed scope03Written output04Next review

Explore primary sources

Training & seminars

Knowledge.
Into action.

Start with the decision your organisation needs to make. We agree the question, audience and useful output before designing the session. International frameworks inform the work; your operating context determines its relevance.

Online

Live online training

Instructor-led sessions for distributed teams, combining discussion, practical cases and exercises. Timing and programme scope are agreed around your participants.

Discuss online training

In person

In-person seminars

Facilitated learning for organisations and professional groups, with cases adapted to your sector and operating environment. Location and delivery are arranged with you.

Plan a seminar
01

Information security education

For teams that need to practise what to do, not only recognise terminology. Work through role-specific cases and leave with agreed actions and a concise learning recap.

  • Cyber hygiene and human-factor risk
  • Electronic documents and data handling
  • Role-specific workshops and exercises
Discuss education
02

Governance and readiness

For leaders reviewing responsibilities, policy gaps or incident readiness. Clarify priorities, assign owners and identify which questions need legal, technical or specialist follow-up.

  • Policy and control mapping
  • Risk and incident scenarios
  • Awareness programme design
Discuss governance
03

Verification research

For decisions that depend on a digital claim or an uncertain source. Trace the evidence, separate facts from assumptions and document the limits before relying on the finding.

  • Provenance and claim mapping
  • Evidence checking and RAG
  • Decision support and risk marking
Discuss research
For leaders and teams
  • Business & leadership teams
  • Public-sector organisations
  • Education & research
  • Professional communities

Ways to work together

A useful first step. A reason to return.

Choose a focused engagement or an ongoing review rhythm. The proposal defines preparation, session time, written outputs and any follow-up, so you can assess the scope before committing.

Regular work with a defined purpose

Each review asks what changed, what was completed and which decision comes next. Frequency, hours, response arrangements and continuation are agreed in writing. Monthly advisory work is scheduled support; it is not a 24/7 monitoring or incident-response service.

Approach

Real context.
Real decisions.

Each programme is adapted to the organisation’s operating environment, applicable frameworks and audience. International reference material is connected with locally relevant cases and decisions.

Request a programme outline
  1. 01

    Frame the context

    Audience, country or region, sector, priorities and operating context.

  2. 02

    Design the intervention

    Learning outcomes, cases, exercises and review criteria.

  3. 03

    Work through practice

    Facilitated analysis, realistic scenarios and documented limits.

  4. 04

    Support the next decision

    Action points, evidence trail and agreed follow-up materials.

Reference environment

A stronger
foundation.

Programmes can be mapped to the organisation’s applicable legal and standards context. A framework is used as a reference point—not as a substitute for evidence, professional judgement or formal legal advice.

NIST CSF 2.0 ↗ ISO/IEC 27001:2022 ↗ NIS2 ↗ GDPR ↗ Cybersecurity Act — 2026 amendment ↗ Decree No. 186 · 19. July 2019 ↗

Two pillars

Information security.
Risk management.

Two disciplines, one decision cycle. Information security protects what the organisation depends on ; risk management decides where protection is worth its cost. ISO/IEC 27001 joins them in a single sentence : the management system „ preserves the confidentiality, integrity and availability of information by applying a risk management process “ [ ISO/IEC 27001:2022, 0.1 ].

Pillar I

Information security

Confidentiality, integrity and availability — kept by design, not by chance. NIST CSF 2.0 organises the work into six Functions with Govern at the centre ; ISO/IEC 27001:2022 turns it into a management system that can be certified.

IDIdentifyPRProtectDEDetectRSRespondRCRecoverGVGOVERN
NIST CSF 2.0 : six Functions, Govern at the centre. Own diagram after NIST CSWP 29 [ 2024 ].
  • 6Functions · NIST CSF 2.0
  • 22Categories · NIST CSF 2.0
  • 93Controls in 4 themes · ISO/IEC 27001:2022, Annex A

Pillar II

Risk management

ISO 31000 defines risk as the „ effect of uncertainty on objectives “ — threat and opportunity alike. The process runs from scope and criteria through assessment to treatment ; COSO ERM ties the same discipline to strategy and performance.

Communication & consultationScopeContextCriteriaRISK ASSESSMENTIdentificationAnalysisEvaluationRisktreatmentMonitoring & reviewRecording & reporting
ISO 31000:2018 risk management process [ clause 6 ]. Own diagram.
  • 8Principles · ISO 31000:2018
  • 5Components · COSO ERM [ 2017 ]
  • 20Principles · COSO ERM [ 2017 ]

GRC

Governance, risk and compliance

OCEG, which introduced the term in 2002, describes GRC as the capabilities that let an organisation „ reliably achieve objectives, address uncertainty, and act with integrity “. The two pillars above are its core ; governance sets direction and accountability, and compliance shows that obligations are met.

Tool · Pillar I

Current and Target Profile

Rate each Function from 1 to 4, using the four CSF 2.0 Tiers as a guide. An illustrative self-assessment, not an audit. Nothing you enter leaves this page.

CurrentTarget

Discuss your results

Tool · Pillar II

Risk register and heat map

Likelihood × consequence on a five-point scale. The levels are an example : risk criteria are set by the organisation [ ISO 31000, 6.3.4 ]. Nothing you enter leaves this page.

Discuss your results

Tool · GRC

NIS2 readiness snapshot

The ten measures of Article 21(2) NIS2, in the Directive’s own words. Mark each one ; the result is an orientation, not a gap analysis or legal advice. Whether and how the measures apply depends on the entity’s status under the Cybersecurity Act. Nothing you enter leaves this page.

    Discuss your results

    References · APA 7

    1. Committee of Sponsoring Organizations of the Treadway Commission. (2017). Enterprise risk management—Integrating with strategy and performance. https://www.coso.org/enterprise-risk-management
    2. Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive). (2022). Official Journal of the European Union, L 333, 80. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
    3. Feng, S., Fourati, A., & Marinelli, V. (2022). ISO/IEC 27002:2022—Information security controls. SC 27 Journal, 2(2). ISO/IEC JTC 1/SC 27. https://committee.iso.org/ … SC27 Journal Vol 2 Issue 2
    4. International Organization for Standardization. (2018). Risk management—Guidelines (ISO Standard No. 31000:2018). https://www.iso.org/standard/65694.html
    5. International Organization for Standardization. (2021a). Compliance management systems—Requirements with guidance for use (ISO Standard No. 37301:2021). https://www.iso.org/standard/75080.html
    6. International Organization for Standardization. (2021b). Governance of organizations—Guidance (ISO Standard No. 37000:2021). https://www.iso.org/standard/65036.html
    7. International Organization for Standardization & International Electrotechnical Commission. (2022a). Information security, cybersecurity and privacy protection—Guidance on managing information security risks (ISO/IEC Standard No. 27005:2022). https://www.iso.org/standard/80585.html
    8. International Organization for Standardization & International Electrotechnical Commission. (2022b). Information security, cybersecurity and privacy protection—Information security controls (ISO/IEC Standard No. 27002:2022). https://www.iso.org/standard/75652.html
    9. International Organization for Standardization & International Electrotechnical Commission. (2022c). Information security, cybersecurity and privacy protection—Information security management systems—Requirements (ISO/IEC Standard No. 27001:2022). https://www.iso.org/standard/27001
    10. International Organization for Standardization & International Electrotechnical Commission. (2024). Information technology—Governance of IT for the organization (ISO/IEC Standard No. 38500:2024). https://www.iso.org/standard/81684.html
    11. ISACA. (2018). COBIT 2019 framework: Introduction and methodology. https://www.isaca.org/resources/cobit
    12. Joint Task Force Transformation Initiative. (2012). Guide for conducting risk assessments (NIST Special Publication 800-30 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-30r1
    13. National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST Cybersecurity White Paper 29). https://doi.org/10.6028/NIST.CSWP.29
    14. OCEG. (n.d.). What is GRC (governance, risk, and compliance)? Retrieved September 29, 2026, from https://www.oceg.org/ideas/what-is-grc/

    Big Four publications on these frameworks

    1. EY · Box, D., Miller, B., & Kipnes, J. (2024, September 16). Technology assurance: How to proceed with confidence. EY. https://www.ey.com/en_us/insights/assurance/technology-assurance-how-to-proceed-with-confidence
    2. Deloitte · Calagna, K., Cassidy, B., & Park, A. (2021). Realize the full potential of artificial intelligence: Applying the COSO framework and principles to help implement and scale artificial intelligence. Committee of Sponsoring Organizations of the Treadway Commission. https://www.deloitte.com/content/dam/assets-zone3/us/en/docs/services/audit-assurance/2024/us-realize-full-potential-artificial-intelligence.pdf
    3. Deloitte · Deloitte Ireland. (2023, August 24). ISO 27001:2022 and ISMS compliance: Achieving compliance, security, and business value. Deloitte. https://www.deloitte.com/ie/en/services/consulting-risk/perspectives/ISO-27001-2022-and-ISMS-Compliance.html
    4. KPMG · KPMG LLP. (2023). Understanding ISMS: People, process, and technology—The importance of information security management systems in the life sciences industry. https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2023/understanding-isms.pdf
    5. PwC · PwC. (2025, October). Overseeing cyber risk: The board’s role. PwC Governance Insights Center. https://www.pwc.com/us/en/services/governance-insights-center/library/overseeing-cyber-risk.html

    Standards are cited from their official publishers. The firms’ publications show how the same frameworks are applied in practice ; Aasfor Limited and ISE. are not affiliated with or endorsed by these firms. Their names are trademarks of the respective companies. Diagrams are original drawings. ISO 31000:2018 remains the current edition ; a revision [ ISO/CD 31000 ] is under development [ status on Tuesday :: 29. September 2026 ].

    About

    Aasfor
    Group.

    Aasfor Group brings an international perspective to information security education, responsible governance and applied research, with attention to local contexts.

    Aasfor Limited was registered at London Paddington [ England ] on .

    Through ISE. and [ SSi. ]  |  [ .иСС ], we connect international frameworks and regional evidence with each organisation’s operating context. Programmes are shaped around local priorities, professional communities and the decisions leaders and teams need to make.

    Clear professional boundaries

    Training and advisory support are scoped for each engagement. They do not represent legal advice, an accredited audit or third-party certification unless this is expressly documented.

    ISE. · [ SSi. ]  |  [ .иСС ] creator, conceptual lead & researcher : Tony Aasfor · ORCID (opens in a new tab)

    Contact

    Make your
    next move.

    Describe the decision or capability you need to improve, who is involved and your target date. We will use this to discuss fit and prepare a written scope, deliverables and fee proposal.

    Connect to Aasfor
    Chat on WhatsApp (opens in a new tab)

    Programmes for organisations and professional groups across regions.

    Delivery and programme scope by arrangement.

    Start with your priorities

    Discuss an engagement.

    Start with one concrete question. Indicate whether you need a session, a workshop or recurring support.

    All fields are required. Your details are used to respond to your enquiry. Privacy notice.

    [ SSi. ] | [ .иСС ] by Aasfor

    Applied research

    Strategic
    Stability iNDEX.

    A developing decision-support framework for examining organisational strategic sustainability through case evidence, incidents and internal and external variables.

    Public communication describes the purpose and evidence logic only. Proprietary weights, thresholds, formulae and calibration are not disclosed.

    Scope note

    [ SSi. ]  |  [ .иСС ] is not presented as a measure of training effect, an automated verdict or a replacement for accountable human judgement.

    Global resource directory

    Global
    intelligence.

    Explore 61 curated resources covering cybersecurity, governance, service management and high-performance computing. Find legislation, guidance, regional reports and data directly from their publishers.

    61 resources · 8 regional collections · Reviewed

    61 resources across 8 collections. Expand a region to browse.

    Global & international12 resources

    • Global professional association

      ISACA (opens in a new tab)

      Governance, audit and risk resources, including COBIT, research and professional learning. Some materials require membership or purchase.

      • Standards & guidance
      • Reports & research
      • Learning & networks
      Explore ISACA resources (opens in a new tab)

    • Global · vendor guide

      Freshworks : ITIL guide (opens in a new tab)

      A practical introduction to ITIL and IT service management, including incident, change and configuration management. Published by software provider Freshworks.

      • Standards & guidance
      • Learning & networks
      freshworks.com

    • International standard

      ISO/IEC 27001 (opens in a new tab)

      Information security management system requirements from ISO. The overview is public; the full standard is sold separately.

      • Standards & guidance
      iso.org

    • International practitioner community

      CIS Controls (opens in a new tab)

      Prioritised safeguards and implementation resources from the Center for Internet Security.

      • Standards & guidance
      cisecurity.org

    • Global professional association

      ISC2 research (opens in a new tab)

      Research on cybersecurity workforce capacity, skills gaps, leadership and professional development.

      • Reports & research
      • Learning & networks
      isc2.org

    • Global research community

      Cloud Security Alliance (opens in a new tab)

      Cloud and AI security research, the Cloud Controls Matrix and assessment resources.

      • Standards & guidance
      • Reports & research
      cloudsecurityalliance.org

    • Global incident-response community

      FIRST (opens in a new tab)

      Incident-response cooperation, team directory and shared standards including CVSS and the Traffic Light Protocol.

      • Learning & networks
      • Alerts & response
      first.org

    • Global application-security community

      OWASP (opens in a new tab)

      Open projects, guidance and educational resources for building and assessing application security.

      • Standards & guidance
      • Learning & networks
      owasp.org

    • Worldwide · 2024 edition

      ITU Global Cybersecurity Index (opens in a new tab)

      Country and regional assessments of cybersecurity commitments across legal, technical, organisational, capacity and cooperation measures.

      • Data & indices
      • Reports & research
      itu.int

    • Worldwide · e-Governance Academy

      National Cyber Security Index (opens in a new tab)

      Country profiles and supporting evidence on national cybersecurity capacities. Check each profile’s assessment date and methodology.

      • Data & indices
      ncsi.ega.ee

    • Worldwide · Shadowserver Foundation

      Shadowserver Dashboard (opens in a new tab)

      Explore observed internet exposures and malicious activity by country and network. Coverage reflects Shadowserver’s measurement systems.

      • Data & indices
      dashboard.shadowserver.org

    • Worldwide · vulnerability data

      FIRST EPSS data (opens in a new tab)

      Download daily vulnerability exploitation-probability estimates and access the EPSS API. Predictions are distinct from confirmed exploitation.

      • Data & indices
      first.org
    Europe19 resources

    • Bulgaria · Bulgarian

      Bulgarian Cybersecurity Act · original ЗКС (opens in a new tab)

      Original act published in State Gazette No. 94 on 13. November 2018. A historical starting point; later amendments must be read separately.

      • Legislation
      dv.parliament.bg

    • Bulgaria · Bulgarian

      Bulgarian Cybersecurity Act · 2026 amendment (opens in a new tab)

      Amending act published in State Gazette No. 17 on 13. February 2026, introducing the NIS2 framework into Bulgarian law. This publication contains amendments, not a consolidated text.

      • Legislation
      dv.parliament.bg

    • Bulgaria · Bulgarian

      Bulgarian minimum security requirements (opens in a new tab)

      Original ordinance adopted by Decree No. 186 of 19. July 2019, published on 26. July 2019. Minimum network and information security requirements; read alongside applicable amendments.

      • Legislation
      dv.parliament.bg

    • European Union · multilingual

      GDPR · General Data Protection Regulation (opens in a new tab)

      Regulation (EU) 2016/679: lawful processing, data-subject rights, accountability, security, breach response and international transfers of personal data.

      • Legislation
      eur-lex.europa.eu

    • Bulgaria · Bulgarian

      Bulgarian Personal Data Protection Act · ЗЗЛД (opens in a new tab)

      National provisions complementing GDPR, published by Bulgaria’s Commission for Personal Data Protection. Read together with the EU regulation.

      • Legislation
      cpdp.bg

    • European Union · multilingual

      NIS2 · Network and Information Security (opens in a new tab)

      Directive (EU) 2022/2555: cybersecurity risk management, incident reporting and supervision. Coverage depends on sector, entity characteristics and national implementation.

      • Legislation
      eur-lex.europa.eu

    • European Union · multilingual

      NIS2 · implementing requirements (opens in a new tab)

      Implementing Regulation (EU) 2024/2690: technical risk-management measures and significant-incident criteria for specified digital infrastructure, digital and trust-service providers.

      • Legislation
      eur-lex.europa.eu

    • European Union · financial sector

      DORA · Digital Operational Resilience Act (opens in a new tab)

      Regulation (EU) 2022/2554: ICT risk management, incident reporting, resilience testing and third-party risk for covered financial entities, with oversight of designated critical ICT providers.

      • Legislation
      eur-lex.europa.eu

    • European Union · digital products

      CRA · Cyber Resilience Act (opens in a new tab)

      Regulation (EU) 2024/2847: cybersecurity requirements for products with digital elements, including vulnerability handling and lifecycle obligations. Application is phased.

      • Legislation
      eur-lex.europa.eu

    • European Union · official summary

      AI Act · artificial intelligence rules (opens in a new tab)

      Official summary linking to Regulation (EU) 2024/1689: AI literacy, risk-based requirements, transparency and human oversight. Scope and application dates vary by provision.

      • Legislation
      eur-lex.europa.eu

    • European Union · critical entities

      CER · Critical Entities Resilience (opens in a new tab)

      Directive (EU) 2022/2557: all-hazards risk assessment, resilience and continuity for covered critical entities. Complements cybersecurity measures through national implementation.

      • Legislation
      eur-lex.europa.eu

    • European Union · official summary

      eIDAS · European Digital Identity (opens in a new tab)

      Official overview of the European Digital Identity framework, digital identity wallets and trust services. Regulation (EU) 2024/1183 amends the eIDAS framework in Regulation (EU) 910/2014.

      • Legislation
      eur-lex.europa.eu

    • European Union

      ENISA Threat Landscape (opens in a new tab)

      EU Agency for Cybersecurity reports on threats, attacker trends, affected sectors and mitigation measures.

      • Reports & research
      enisa.europa.eu

    • European Union institutions

      CERT-EU (opens in a new tab)

      Security advisories and threat reporting from the cybersecurity service for EU institutions, bodies, offices and agencies.

      • Alerts & response
      • Reports & research
      cert.europa.eu

    • United Kingdom

      NCSC UK (opens in a new tab)

      Practical security guidance, advisories and resources for organisations and individuals.

      • Alerts & response
      • Standards & guidance
      ncsc.gov.uk

    • Germany · English resource

      BSI IT-Grundschutz course (opens in a new tab)

      An introduction to the IT-Grundschutz information security approach from Germany’s Federal Office for Information Security.

      • Standards & guidance
      • Learning & networks
      bsi.bund.de

    • France · French and selected English reports

      ANSSI / CERT-FR (opens in a new tab)

      Official alerts, vulnerability notices, incident analyses and threat reports from France’s national and governmental CERT.

      • Alerts & response
      • Reports & research
      cert.ssi.gouv.fr

    • Bulgaria · Bulgarian resources

      CERT Bulgaria (opens in a new tab)

      National computer-security incident response, alerts and practical security information.

      • Alerts & response
      govcert.bg

    • European Union · multilingual

      EUR-Lex : EU Cybersecurity Act (opens in a new tab)

      Official summary with links to the legislation on ENISA and the European cybersecurity certification framework.

      • Legislation
      • Standards & guidance
      eur-lex.europa.eu
    Asia7 resources

    • Asia-Pacific regional network

      APCERT (opens in a new tab)

      Regional incident-response cooperation, exercises and annual reports from member teams across Asia-Pacific.

      • Alerts & response
      • Reports & research
      • Learning & networks
      apcert.org

    • Japan · English reports

      JPCERT/CC quarterly reports (opens in a new tab)

      Periodic reports on incidents handled by JPCERT/CC. Use the reporting period and incident definitions when interpreting totals.

      • Reports & research
      • Data & indices
      jpcert.or.jp

    • India

      CERT-In (opens in a new tab)

      India’s national computer emergency response team : security advisories, vulnerability notes and incident-response information.

      • Alerts & response
      cert-in.org.in

    • Singapore

      CSA Singapore publications (opens in a new tab)

      Singapore Cyber Landscape reports and guidance on organisational, AI and infrastructure security.

      • Reports & research
      • Standards & guidance
      csa.gov.sg

    • Republic of Korea · English portal

      KISA (opens in a new tab)

      Cybersecurity publications, capacity-building materials and software supply-chain guidance from the Korea Internet & Security Agency.

      • Reports & research
      • Standards & guidance
      • Learning & networks
      kisa.kr

    • China · Chinese portal

      CNCERT/CC (opens in a new tab)

      National incident-response information, security notices and cybersecurity reporting from China’s coordination centre.

      • Alerts & response
      • Reports & research
      cert.org.cn

    • Hong Kong

      HKCERT (opens in a new tab)

      Security alerts, bulletins and threat information from the Hong Kong Computer Emergency Response Team Coordination Centre.

      • Alerts & response
      • Reports & research
      hkcert.org
    Africa8 resources
    Middle East2 resources
    North America6 resources

    • United States · government programme

      HPC.mil — HPCMP (opens in a new tab)

      The High Performance Computing Modernization Program : supercomputing, research networks, scientific software and user guidance. Some services require authorised access.

      • Standards & guidance
      • Learning & networks
      hpc.mil

    • United States · used internationally

      NIST Cybersecurity Framework (opens in a new tab)

      CSF 2.0, quick-start guides, profiles, mappings and translations for managing organisational cybersecurity risk.

      • Standards & guidance
      nist.gov

    • United States · global software coverage

      NIST National Vulnerability Database (opens in a new tab)

      Searchable vulnerability records and supporting data for vulnerability assessment and management.

      • Data & indices
      • Alerts & response
      nvd.nist.gov

    • United States · global software coverage

      CISA Known Exploited Vulnerabilities (opens in a new tab)

      A catalog of vulnerabilities with evidence of exploitation, used to support remediation prioritisation.

      • Data & indices
      • Alerts & response
      cisa.gov

    • United States · global knowledge base

      MITRE ATT&CK (opens in a new tab)

      Documented adversary tactics and techniques, with mitigations and structured knowledge for defensive analysis.

      • Data & indices
      • Standards & guidance
      attack.mitre.org

    • Canada · English and French

      Canadian Centre for Cyber Security (opens in a new tab)

      National cyberthreat assessments, security alerts and practical guidance from Canada’s cyber security authority.

      • Alerts & response
      • Reports & research
      • Standards & guidance
      cyber.gc.ca
    Latin America & Caribbean3 resources

    • Brazil · Portuguese

      CERT.br statistics (opens in a new tab)

      Public statistics on incident reports, phishing, exposed services and observed malicious traffic. Series have different collection methods.

      • Data & indices
      • Reports & research
      stats.cert.br

    • Americas · Latin America and Caribbean

      OAS cybersecurity programme (opens in a new tab)

      Regional cybersecurity capacity building, policy support, cooperation and resources from the Organization of American States.

      • Standards & guidance
      • Learning & networks
      oas.org

    • Uruguay · Spanish

      CERTuy (opens in a new tab)

      National incident-response guidance, security notices and publications from Uruguay’s CERT.

      • Alerts & response
      • Reports & research
      gub.uy
    Oceania & Pacific4 resources

    • Australia

      ASD Australian Cyber Security Centre (opens in a new tab)

      Official alerts, security guidance and resources for government, organisations, businesses and individuals.

      • Alerts & response
      • Standards & guidance
      cyber.gov.au

    • Australia · defensive framework

      ASD Essential Eight (opens in a new tab)

      Mitigation strategies and supporting maturity guidance for reducing exposure to common cyber threats.

      • Standards & guidance
      cyber.gov.au

    • New Zealand

      NCSC New Zealand (opens in a new tab)

      Quarterly cyber security insights, annual threat reports, alerts and organisational guidance.

      • Reports & research
      • Alerts & response
      • Data & indices
      ncsc.govt.nz

    • Pacific island countries and territories

      PaCSON (opens in a new tab)

      Pacific operational cooperation, learning materials and links to national cybersecurity teams across the region.

      • Alerts & response
      • Learning & networks
      pacson.org

    Data coverage, reporting periods and methods differ between publishers. Check the original methodology before comparing countries or incident totals. This directory links to external resources; it does not provide a live data feed.

    Further reading & Aasfor Group

    Analysis and guidance

    Organisations and frameworks

    Aasfor Group

    Open sources. Verifiable findings.

    OSINT — Open-source intelligence

    A practical introduction to responsible research, verification and the tools that support it.

    OSINT is the structured collection, verification and analysis of publicly available information to answer a specific question. Sources may include official registers, publications, maps and publicly accessible websites. “Open source” describes the information sources; it does not mean every tool is free or open-source software.

    ISE. and Aasfor Group neither sell nor advertise these tools or materials in any form and do not act as sales intermediaries. Links are provided solely for information and independent research. Any purchase or subscription is arranged directly with the external provider.

    Lawful and transparent use

    Define the purpose and legal basis

    Public access is not unlimited permission to reuse information. Where GDPR applies, establish a lawful basis, collect only necessary personal data, keep it accurate and secure, and set a retention period. Assess transparency duties and any applicable exceptions.

    Respect access and publication boundaries

    Use sources you may lawfully access. Respect licences, copyright and platform terms. Do not bypass access controls or use stolen credentials. Active testing requires prior authorisation and an agreed scope. Before sharing findings, remove unnecessary personal data and assess potential harm.

    This is general educational guidance, not legal advice or permission for a particular investigation. Applicable rules depend on the jurisdiction, data and purpose; seek qualified advice when the legal basis is unclear.

    European Commission : GDPR principles (opens in a new tab)

    A repeatable verification process

    1. Define a question, purpose and permitted scope before collecting data.
    2. Record the original source, URL, access date and relevant context. Preserve material only where permitted.
    3. Cross-check independent sources; examine dates, location and whether images or claims have been reused.
    4. Separate confirmed facts, assumptions and unresolved questions. A tool result is a lead, not proof.
    5. Document your reasoning and limitations. Share only what is necessary and review retention.
    Berkeley Protocol : investigation methodology (opens in a new tab)

    Tools and official provider links

    These are reference examples, not a ranking, advertisement or claim of institutional approval. “Official” refers to the linked developer or provider page, not an official recommendation. Check current availability, licence terms and service limits with each provider.

    Maltego Graph

    Free and paid plans; provider limits apply.

    Visual link analysis across datasets. Useful for organising relationships and documenting research leads; check the provenance and lawful use of every connected data source.

    Official developer / provider (opens in a new tab)

    SpiderFoot

    Free open-source software; some external APIs may charge.

    Automates collection and correlation from multiple sources. Review modules before use : some interact with target systems. Use passive sources for open-source research and obtain authorisation before active testing.

    Official developer / provider (opens in a new tab)

    InVID Verification Plugin

    Free plugin; external services have their own terms.

    Supports image and video verification through keyframes, reverse-image searches and metadata inspection. Results require context and independent confirmation.

    Official developer / provider (opens in a new tab)

    Google Earth Pro

    Desktop edition; check current provider terms.

    Compare terrain and historical imagery to assess location and changes over time. Check imagery dates and attribution requirements before drawing conclusions or publishing.

    Official developer / provider (opens in a new tab)

    For further discovery, Bellingcat maintains an investigation toolkit. Its inclusion here does not mean Bellingcat endorses this site or every example above.

    Bellingcat : Online Investigation Toolkit (opens in a new tab)

    Selected reading

    Reading Library

    Start with the free resources, then explore 15 selected books with reading notes and 97 further references grouped by topic.

    ISE. by Aasfor provides these reading lists to help visitors to its website find publicly available information and resources. ISE. by Aasfor does not sell these publications, has no direct relationships with their authors and accepts no responsibility for the publications or their content.

    Descriptions and suggested learning uses are our editorial selection. Titles remain in their original language. The listed editions are references, not necessarily the latest; check current standards and software documentation alongside them.

    Free resources

    Read these resources free of charge from their authors’ websites or repositories. Access checked on 14. September 2026.

    Free full text · English

    The Art of Assembly Language Programming

    Free DOS / 16-bit edition in HTML and PDF, provided by Randall Hyde. This older edition is no longer maintained and differs from the published 2nd edition listed below.

    Read free — author’s website (opens in a new tab)

    Selected books and further reading

    Security governance3

    Foundation

    Cybersecurity Threats, Malware Trends, and Strategies

    Tim Rains

    2nd edition · 2023

    Connect threat trends with security investment decisions. Useful for leadership discussions on priorities and risk.

    Learning focus : Governance and readiness

    Official book page (opens in a new tab)

    Advanced

    Industrial Cybersecurity

    Pascal Ackerman

    2nd edition · 2021

    Explore the operational constraints of industrial systems. Use alongside current standards when discussing critical infrastructure resilience.

    Learning focus : Governance and readiness

    Official book page (opens in a new tab)

    Advanced

    Automotive Cybersecurity Engineering Handbook

    Dr. Ahmad MK Nasser

    1st edition · 2023

    A sector-specific view of secure development and vehicle risk. Supports discussions of engineering responsibilities and supplier assurance.

    Learning focus : Governance and readiness

    Official book page (opens in a new tab)
    OSINT and evidence4

    Intermediate

    Mastering Cyber Intelligence

    Jean Nestor M. Dahj

    1st edition · 2022

    Follow the intelligence cycle from requirements to reporting. Useful for OSINT source assessment and turning observations into defensible conclusions.

    Learning focus : Verification research

    Official book page (opens in a new tab)

    Intermediate

    Incident Response with Threat Intelligence

    Roberto Martinez

    1st edition · 2022

    Connect intelligence with investigation priorities. Supports exercises on choosing relevant evidence during an incident.

    Learning focus : Verification research

    Official book page (opens in a new tab)

    Intermediate

    Learn Computer Forensics

    William Oettinger

    2nd edition · 2022

    Build disciplined evidence collection and documentation habits. A useful bridge between technical findings and a reviewable investigation.

    Learning focus : Verification research

    Official book page (opens in a new tab)

    Advanced

    Digital Forensics with Kali Linux

    Shiva V. N. Parasram

    3rd edition · 2023

    Practise examining memory and network evidence in a controlled lab. Best for learners already comfortable with Linux.

    Learning focus : Verification research

    Official book page (opens in a new tab)
    Cyber risk and response3

    Intermediate

    Digital Forensics and Incident Response

    Gerard Johansen

    3rd edition · 2022

    Connect incident preparation, investigation and response. Useful for designing team scenarios and reviewing the evidence behind decisions.

    Learning focus : Risk and incident scenarios

    Official book page (opens in a new tab)

    Intermediate

    Mastering Defensive Security

    Cesar Bravo

    1st edition · 2022

    Compare defensive measures across systems and infrastructure. Supports practical conversations about layered protection and control selection.

    Learning focus : Risk and incident scenarios

    Official book page (opens in a new tab)

    Advanced

    Malware Analysis Techniques

    Dylan Barker

    1st edition · 2021

    Develop a structured approach to malware triage. Use for specialist defensive analysis in an isolated training environment.

    Learning focus : Risk and incident scenarios

    Official book page (opens in a new tab)
    Technical foundations5

    Foundation

    Computer Security : Principles and Practice, Global Edition

    William Stallings; Lawrie Brown

    5th edition · 2024

    A broad reference for core security concepts. Start here to build shared vocabulary before specialised workshops.

    Learning focus : Information security education

    Official book page (opens in a new tab)

    Advanced

    Cryptography Engineering

    Niels Ferguson; Bruce Schneier; Tadayoshi Kohno

    1st edition · 2010

    Understand why secure cryptographic design depends on implementation choices. A conceptual reference to pair with current algorithm guidance.

    Learning focus : Information security education

    Official book page (opens in a new tab)

    Intermediate

    Learn Wireshark

    Lisa Bock

    2nd edition · 2022

    Learn to interpret network traffic rather than guess at its meaning. Useful preparation for packet-analysis exercises.

    Learning focus : Information security education

    Official book page (opens in a new tab)

    Intermediate

    Mastering Linux Security and Hardening

    Donald A. Tevault

    3rd edition · 2023

    Translate security principles into Linux administration tasks. Supports workshops on access controls and system hardening.

    Learning focus : Information security education

    Official book page (opens in a new tab)

    Advanced

    Attacking and Exploiting Modern Web Applications

    Simone Onofri; Donato Onofri

    1st edition · 2023

    Understand web application weaknesses from a tester’s perspective. Use in authorised labs to connect findings with defensive improvements.

    Learning focus : Information security education

    Official book page (opens in a new tab)

    Further reading

    Explore available editions and access options through Google Books or the publisher’s official website.

    Some books may be available for free or may no longer be sold.

    Cryptography and quantum computing22
    1. A Practical Guide to Quantum Machine Learning and Quantum OptimizationFind an edition · Google Books (opens in a new tab)
    2. Cryptography Algorithms: A Guide to Algorithms in Blockchain, Quantum Cryptography, Zero-Knowledge Protocols (Massimo Bertaccini)Find an edition · Google Books (opens in a new tab)
    3. Cryptography Algorithms: Explore New Algorithms in Zero-Knowledge, Homomorphic Encryption, and Quantum Cryptography, 2nd Edition (Massimo Bertaccini)Find an edition · Google Books (opens in a new tab)
    4. Cryptography and Network Security: Principles and Practice, Global Edition (William Stallings)Find an edition · Google Books (opens in a new tab)
    5. Cryptography and Security Services: Mechanisms and ApplicationsFind an edition · Google Books (opens in a new tab)
    6. Cryptography, Information Theory, and Error-Correction: A Handbook for the 21st Century, 2nd EditionFind an edition · Google Books (opens in a new tab)
    7. Cryptography: Algorithms, Protocols, and Standards for Computer Security (Zoubir Mammeri)Find an edition · Google Books (opens in a new tab)
    8. Cryptography: Theory and Practice (Stinson, Paterson; 2019)Find an edition · Google Books (opens in a new tab)
    9. Dancing with Qubits, Second Edition (Robert S. Sutor)Find an edition · Google Books (opens in a new tab)
    10. Demystifying Cryptography with OpenSSL 3.0 (Alexei Khlebnikov)Find an edition · Google Books (opens in a new tab)
    11. Elliptic Curves: Number Theory and Cryptography (Lawrence C. Washington)Find an edition · Google Books (opens in a new tab)
    12. Encyclopedia of Cryptography and Security, 2nd Edition (Henk C. A. van Tilborg, Sushil Jajodia, editors)Find an edition · Google Books (opens in a new tab)
    13. Hardware Oriented Authenticated Encryption Based on Tweakable Block Ciphers (Mustafa Khairallah)Find an edition · Google Books (opens in a new tab)
    14. Holistic Approach to Quantum Cryptography in Cyber SecurityFind an edition · Google Books (opens in a new tab)
    15. Introduction to Modern Cryptography (Jonathan Katz, Yehuda Lindell)Find an edition · Google Books (opens in a new tab)
    16. Introduction to Quantum Cryptography (T. Vidick)Find an edition · Google Books (opens in a new tab)
    17. Modern Cryptography for Cybersecurity Professionals (Lisa Bock)Find an edition · Google Books (opens in a new tab)
    18. Modern Cryptography Volume 1: A Classical Introduction to Informational and Mathematical Principle (Zhiyong Zheng)Find an edition · Google Books (opens in a new tab)
    19. Post-Quantum Cryptography (Thomas Johansson, Daniel Smith-Tone)Find an edition · Google Books (opens in a new tab)
    20. Quantum Computing Algorithms (Barry Burd)Find an edition · Google Books (opens in a new tab)
    21. SSL and TLS: Theory and Practice, 3rd Edition (Rolf Oppliger)Find an edition · Google Books (opens in a new tab)
    22. TLS Cryptography In-Depth (Paul Duplys, Roland Schmitz)Find an edition · Google Books (opens in a new tab)
    Linux, Windows and network administration13
    1. Implementing Palo Alto Prisma Access (Tom Piens)Find an edition · Google Books (opens in a new tab)
    2. Linux Administration: A Beginner’s Guide, Eighth Edition (Wale Soyinka)Find an edition · Google Books (opens in a new tab)
    3. Linux Command Line and Shell Scripting Techniques (Vedran Dakic, Jasmin Redzepagic)Find an edition · Google Books (opens in a new tab)
    4. Linux Device Driver Development, 2nd Edition (John Madieu)Find an edition · Google Books (opens in a new tab)
    5. Linux for Networking Professionals (Rob VandenBrink)Find an edition · Google Books (opens in a new tab)
    6. Linux Kernel Programming (Kaiwan N. Billimoria)Find an edition · Google Books (opens in a new tab)
    7. Linux System Programming Techniques (Jack-Benny Persson)Find an edition · Google Books (opens in a new tab)
    8. Mastering Active Directory, 3rd Edition (Dishan Francis)Find an edition · Google Books (opens in a new tab)
    9. Mastering Embedded Linux Programming (Frank Vasquez, Chris Simmonds)Find an edition · Google Books (opens in a new tab)
    10. Mastering Linux Administration (Alexandru Calcatinge, Julian Balog)Find an edition · Google Books (opens in a new tab)
    11. Mastering Palo Alto Networks (Tom Piens)Find an edition · Google Books (opens in a new tab)
    12. Mastering Windows Security and Hardening, 2nd Edition (Mark Dunkerley, Matt Tumbarello)Find an edition · Google Books (opens in a new tab)
    13. SELinux System Administration (Sven Vermeulen)Find an edition · Google Books (opens in a new tab)
    Assembly, architecture and reverse engineering16
    1. Assembly Language for x86 Processors, 7th editionFind an edition · Google Books (opens in a new tab)
    2. Assembly Language Step-By-Step: Programming with Linux, 3rd edition (2009)Find an edition · Google Books (opens in a new tab)
    3. AT&T Assembly LanguageFind an edition · Google Books (opens in a new tab)
    4. Blue Fox: ARM Assembly Internals and Reverse EngineeringFind an edition · Google Books (opens in a new tab)
    5. Ghidra Software Reverse Engineering for Beginners (A. P. David)Find an edition · Google Books (opens in a new tab)
    6. Guide to Assembly Language Programming in LinuxFind an edition · Google Books (opens in a new tab)
    7. Mastering Reverse Engineering (Reginald Wong)Find an edition · Google Books (opens in a new tab)
    8. Modern Computer Architecture and Organization, 2nd Edition (Jim Ledin)Find an edition · Google Books (opens in a new tab)
    9. Modern x86 Assembly Language Programming: Covers x86 64-Bit, AVX, AVX2, and AVX-512Find an edition · Google Books (opens in a new tab)
    10. Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and ObfuscationFind an edition · Google Books (opens in a new tab)
    11. Reversing: Secrets of Reverse Engineering (2005)Find an edition · Google Books (opens in a new tab)
    12. The Art of Assembly Language, 2nd EditionFind an edition · Google Books (opens in a new tab)
    13. Write Great Code, Vol. 2: Thinking Low-Level, Writing High-LevelFind an edition · Google Books (opens in a new tab)
    14. x86 Software Reverse-Engineering, Cracking, and Counter-Measures (Stephanie Domas, Christopher Domas)Find an edition · Google Books (opens in a new tab)
    15. Ассемблер — это просто. Учимся программировать. 2 изд.Find an edition · Google Books (opens in a new tab)
    16. Искусство дизассемблированияFind an edition · Google Books (opens in a new tab)
    Security testing and web applications23
    1. Advanced Persistent Threat Hacking: The Art and Science of Hacking Any Organization (Tyler Wrightson)Official book page (opens in a new tab)
    2. CEH: Ethical Hacking and Countermeasures v11 (EC-Council)Find an edition · Google Books (opens in a new tab)
    3. Certified Ethical Hacker (CEH) v12 312-50Find an edition · Google Books (opens in a new tab)
    4. Gray Hat Hacking: The Ethical Hacker’s Handbook, Sixth Edition (Daniel Regalado, Jonathan Ness, Chris Eagle et al.)Find an edition · Google Books (opens in a new tab)
    5. Hands-On Ethical Hacking Tactics (Shane Hartman, Ken Dunham)Find an edition · Google Books (opens in a new tab)
    6. Learning Kali Linux, 2nd Edition (Ric Messier)Find an edition · Google Books (opens in a new tab)
    7. Mastering Kali Linux for Advanced Penetration Testing (Vijay Kumar Velu)Find an edition · Google Books (opens in a new tab)
    8. Mastering Metasploit, 4th Edition (Nipun Jaswal)Find an edition · Google Books (opens in a new tab)
    9. Metasploit, 2nd Edition (David Kennedy, Mati Aharoni, Devon Kearns et al.)Find an edition · Google Books (opens in a new tab)
    10. Nmap Network Exploration and Security Auditing CookbookFind an edition · Google Books (opens in a new tab)
    11. Offensive Security: Penetration Testing with Kali LinuxFind an edition · Google Books (opens in a new tab)
    12. Penetration Testing with Kali Linux: PEN-200 2023 (Offensive Security)Find an edition · Google Books (opens in a new tab)
    13. Pentesting Industrial Control SystemsFind an edition · Google Books (opens in a new tab)
    14. Practical Hardware Pentesting (Jean-Georges Valle; 2021)Find an edition · Google Books (opens in a new tab)
    15. Privilege Escalation Techniques (Alexis Ahmed)Find an edition · Google Books (opens in a new tab)
    16. Reconnaissance for Ethical HackersFind an edition · Google Books (opens in a new tab)
    17. Spring Security (Badr Nasslahsen)Find an edition · Google Books (opens in a new tab)
    18. The Ultimate Kali Linux Book, 2nd Edition (Glen D. Singh)Find an edition · Google Books (opens in a new tab)
    19. The Ultimate Kali Linux Book, 3rd Edition (Glen D. Singh)Find an edition · Google Books (opens in a new tab)
    20. Traditional vs Generative AI Pentesting: A Hands-On Approach to Hacking (Yassine Maleh)Find an edition · Google Books (opens in a new tab)
    21. Web Application Security, 2nd Edition (Andrew Hoffman)Find an edition · Google Books (opens in a new tab)
    22. Web Hacking Arsenal (Rafay Baloch)Find an edition · Google Books (opens in a new tab)
    23. Windows and Linux Penetration Testing from Scratch (Phil Bramwell)Find an edition · Google Books (opens in a new tab)
    Forensics, malware and intelligence9
    1. Digital Forensics with Kali Linux (Shiva V. N. Parasram; edition unspecified)Find an edition · Google Books (opens in a new tab)
    2. Malware Analysis and Detection Engineering (Abhijit Mohanta, Anoop Saldanha)Find an edition · Google Books (opens in a new tab)
    3. Mastering Linux Security and Hardening: Protect Your Linux Systems from Intruders, Malware Attacks, and Other Cyber Threats (Donald A. Tevault)Find an edition · Google Books (opens in a new tab)
    4. Operationalizing Threat Intelligence (Kyle Wilhoit, Joseph Opacki)Find an edition · Google Books (opens in a new tab)
    5. OSINT Techniques (Michael Bazzell)Find an edition · Google Books (opens in a new tab)
    6. Practical Memory Forensics (Svetlana Ostrovskaya, Oleg Skulkin)Find an edition · Google Books (opens in a new tab)
    7. The Android Malware Handbook (Qian Han, Salvador Mandujano et al.)Find an edition · Google Books (opens in a new tab)
    8. Windows Forensics (Chuck Easttom, William Butler et al.)Find an edition · Google Books (opens in a new tab)
    9. Windows Forensics Analyst Field Guide (Muhibullah Mohammed)Find an edition · Google Books (opens in a new tab)
    Security architecture, AI and foundations14
    1. CEH v12 Professional Series (Peter Griffin)Find an edition · Google Books (opens in a new tab)
    2. CompTIA Security+ Guide to Network Security Fundamentals, 8th Edition (Mark Ciampa)Find an edition · Google Books (opens in a new tab)
    3. Computer Security Handbook, 6th EditionFind an edition · Google Books (opens in a new tab)
    4. Cybersecurity Architect’s Handbook (Lester Nichols)Find an edition · Google Books (opens in a new tab)
    5. Cybersecurity – Attack and Defense Strategies, 2nd Edition (Yuri Diogenes, Erdal Ozkaya)Find an edition · Google Books (opens in a new tab)
    6. Cybersecurity – Attack and Defense Strategies: Improve Your Security Posture to Mitigate Risks and Prevent Attackers (Yuri Diogenes, Erdal Ozkaya)Find an edition · Google Books (opens in a new tab)
    7. Cybersecurity: Managing Systems, Conducting Testing, and Investigating Intrusions (Thomas J. Mowbray)Find an edition · Google Books (opens in a new tab)
    8. Generative AI Security: Theories and Practices (Ken Huang, Yang Wang, Ben Goertzel, Yale Li et al.)Find an edition · Google Books (opens in a new tab)
    9. Hack the Cybersecurity InterviewFind an edition · Google Books (opens in a new tab)
    10. Nanoscale Computing (Sivasubramani; 2024)Find an edition · Google Books (opens in a new tab)
    11. Practical Industrial Cybersecurity: ICS, Industry 4.0, and IIoT (Charles J. Brooks, Philip A. Craig Jr.)Find an edition · Google Books (opens in a new tab)
    12. Red Teaming AI: Attacking and Defending Intelligent Systems (Philip A. Dursey)Find an edition · Google Books (opens in a new tab)
    13. Reinforcement Learning for Cyber Operations (Rahman; 2024)Find an edition · Google Books (opens in a new tab)
    14. Zero Trust Networks, 2nd Edition (Razi Rais, Christina Morillo, Evan Gilman et al.)Find an edition · Google Books (opens in a new tab)

    Any purchases, payments and access arrangements are solely between the reader and the external publisher, author or supplier.