Guided Defense Playbooks

Turn the knowledge graph into an action path.

Choose a real defensive objective, follow the most relevant NIST CSF outcomes into the Cross-Framework Defense Map, and use the linked controls, CUI requirements, D3FEND techniques, ATT&CK context, books, podcasts, and Academy lessons to deepen the work.

12Playbooks

60Guided phases

89CSF outcomes

186Mapped controls

Bare Metal Cyber editorial guidance · Built on the source-controlled v0.2.16 Defense Map

Open the complete Defense Map →

Choose a mission

Start with the outcome you need—not the framework you already know.

Each playbook is a curated educational route. Official NIST and MITRE relationships remain labeled separately from Bare Metal Cyber editorial sequencing.

Protect systems and information

5 playbooks

PB-01

Identity defense playbook

Identity and Privileged Access

Build a governed identity lifecycle, strengthen authentication, enforce least privilege, and monitor how human, service, and device identities are used.

Phases: 5
Outcomes: 10
Controls: 75

Open playbook →PB-05

Architecture playbook

Zero Trust

Build explicit trust decisions around identity, devices, workloads, networks, data, policy enforcement, telemetry, and continuous adaptation.

Phases: 5
Outcomes: 16
Controls: 112

Open playbook →PB-06

Cloud operating model playbook

Cloud Security

Govern cloud providers, inventory services and data, secure identities and configurations, protect telemetry, and maintain resilience across shared-responsibility boundaries.

Phases: 5
Outcomes: 18
Controls: 92

Open playbook →PB-09

Information protection playbook

Data Protection

Inventory and prioritize data, enforce access, protect data in every state, maintain trusted backups, and preserve evidence during incidents and recovery.

Phases: 5
Outcomes: 12
Controls: 77

Open playbook →PB-10

Exposure reduction playbook

Vulnerability Management

Connect asset context, vulnerability discovery, threat and impact analysis, risk-based prioritization, remediation, verification, and continuous improvement.

Phases: 5
Outcomes: 16
Controls: 81

Open playbook →

Detect, respond, and recover

4 playbooks

PB-02

Detection engineering playbook

Logging and Detection

Turn asset context and log generation into monitored telemetry, correlated analysis, declared incidents, and repeatable detection improvement.

Phases: 5
Outcomes: 14
Controls: 76

Open playbook →PB-03

Resilience playbook

Ransomware Resilience

Reduce ransomware entry and spread, protect recoverability, detect destructive activity, contain impact, and restore trusted operations.

Phases: 5
Outcomes: 14
Controls: 64

Open playbook →PB-04

Incident operations playbook

Incident Response

Prepare the organization to declare, manage, investigate, contain, communicate, recover from, and learn from cybersecurity incidents.

Phases: 5
Outcomes: 20
Controls: 54

Open playbook →PB-12

Operational resilience playbook

Continuity and Recovery

Map mission dependencies, plan for disruption, protect capacity and backups, execute recovery, verify restored operations, communicate progress, and improve through exercises.

Phases: 5
Outcomes: 18
Controls: 67

Open playbook →

Govern risk and resilience

3 playbooks

PB-07

Controlled information playbook

CUI Protection

Scope Controlled Unclassified Information, establish responsibility, apply SP 800-171 and selected SP 800-172 safeguards, preserve evidence, and sustain protection.

Phases: 5
Outcomes: 16
Controls: 111

Open playbook →PB-08

Third-party risk playbook

Supply Chain Risk

Establish a cybersecurity supply-chain program, prioritize suppliers, set agreement requirements, monitor risk across the lifecycle, and integrate suppliers into incident and recovery work.

Phases: 5
Outcomes: 15
Controls: 61

Open playbook →PB-11

AI risk playbook

AI Security and Governance

Govern AI systems, data, models, services, identities, dependencies, risks, safeguards, monitoring, exceptions, and improvement as part of the wider cybersecurity program.

Phases: 5
Outcomes: 22
Controls: 124

Open playbook →

Relationship boundaries

Guidance without overclaiming.

Playbook sequence, priorities, checkpoints, and completion evidence are original Bare Metal Cyber editorial guidance. NIST informative references, source-control relationships, D3FEND semantic mappings, curated ATT&CK mitigation mappings, and inferred ATT&CK relationships retain their established labels and limitations.