{
  "source": "https://github.com/sepand/ZTLens",
  "license": "CC BY-SA 4.0",
  "generatedFrom": "data/capabilities.yaml",
  "count": 28,
  "capabilities": [
    {
      "id": "app-microsegmentation",
      "pillar": "Application & Workload",
      "capability": "Application-Layer Micro-Segmentation",
      "traditional": "Flat network, coarse VLAN segmentation",
      "advanced": "Workload-aware segmentation via service mesh or NGFW policies",
      "optimal": "Fully dynamic, identity-based segmentation per workload/session",
      "frameworks": [
        {
          "framework": "NIST 800-207",
          "ref": "Sec 3.4"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "1.3"
        }
      ]
    },
    {
      "id": "app-secure-sdlc",
      "pillar": "Application & Workload",
      "capability": "Secure Software Development Lifecycle",
      "traditional": "Manual code review, ad hoc testing",
      "advanced": "Automated SAST/DAST in CI/CD with gated deploys",
      "optimal": "Continuous security validation with runtime application self-protection (RASP)",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "SA-11"
        },
        {
          "framework": "SOX (ITGC)",
          "ref": "Change Management"
        }
      ]
    },
    {
      "id": "app-transaction-integrity",
      "pillar": "Application & Workload",
      "capability": "Payment & Transaction Integrity Controls",
      "traditional": "Manual dual-control sign-off on high-value transactions",
      "advanced": "Automated dual-control with anomaly-based transaction holds",
      "optimal": "Real-time, ML-based transaction risk scoring integrated into the release/approval workflow",
      "frameworks": [
        {
          "framework": "PCI-DSS v4.0",
          "ref": "6"
        },
        {
          "framework": "SWIFT CSP",
          "ref": "2.1"
        }
      ]
    },
    {
      "id": "app-vendor-risk",
      "pillar": "Application & Workload",
      "capability": "Third-Party Software & Vendor Risk Management",
      "traditional": "Annual vendor security questionnaires",
      "advanced": "Continuous vendor security ratings and SBOM review for critical vendors",
      "optimal": "Automated, continuous third-party risk scoring gating production integration",
      "frameworks": [
        {
          "framework": "NYDFS 500",
          "ref": "500.11"
        },
        {
          "framework": "GLBA (Safeguards Rule)",
          "ref": "16 CFR 314.4(f)"
        },
        {
          "framework": "SOX (ITGC)",
          "ref": "Vendor Management"
        }
      ]
    },
    {
      "id": "automation-change-management",
      "pillar": "Automation & Orchestration",
      "capability": "Change Management / Policy-as-Code Governance",
      "traditional": "Manual change tickets; ad hoc approval",
      "advanced": "Automated CI/CD-gated change approval with policy checks",
      "optimal": "Fully automated, auditable change pipeline with real-time compliance validation",
      "frameworks": [
        {
          "framework": "SOX (ITGC)",
          "ref": "Change Management"
        },
        {
          "framework": "NIST 800-53",
          "ref": "CM-3"
        }
      ]
    },
    {
      "id": "automation-orchestration",
      "pillar": "Automation & Orchestration",
      "capability": "Security Orchestration, Automation & Response (SOAR)",
      "traditional": "Manual incident response runbooks",
      "advanced": "Automated playbooks for common alert types",
      "optimal": "Policy-driven, self-healing response integrated across all pillars",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "IR-4"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.16"
        }
      ]
    },
    {
      "id": "automation-policy-engine",
      "pillar": "Automation & Orchestration",
      "capability": "Centralized Policy Decision Point (PDP)",
      "traditional": "Policy enforced locally per system, no central authority",
      "advanced": "Centralized PDP/PEP model for major application tiers",
      "optimal": "Unified PDP evaluating real-time risk signals across all pillars for every access request",
      "frameworks": [
        {
          "framework": "NIST 800-207",
          "ref": "Sec 3.2 (PDP/PEP model)"
        }
      ]
    },
    {
      "id": "automation-regulatory-reporting",
      "pillar": "Automation & Orchestration",
      "capability": "Regulatory Reporting Automation",
      "traditional": "Manual compilation of compliance evidence",
      "advanced": "Semi-automated evidence collection for audits",
      "optimal": "Continuous, automated compliance reporting and regulator-ready evidence packages",
      "frameworks": [
        {
          "framework": "NYDFS 500",
          "ref": "500.17"
        },
        {
          "framework": "SOX (ITGC)",
          "ref": "Monitoring"
        }
      ]
    },
    {
      "id": "data-classification",
      "pillar": "Data",
      "capability": "Data Classification & Labeling",
      "traditional": "Manual, inconsistent classification",
      "advanced": "Automated classification via DLP/CASB tooling",
      "optimal": "Continuous, ML-assisted classification enforcing access policy in real time",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "RA-2"
        },
        {
          "framework": "GLBA (Safeguards Rule)",
          "ref": "16 CFR 314.4(c)"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.03"
        }
      ]
    },
    {
      "id": "data-encryption",
      "pillar": "Data",
      "capability": "Encryption at Rest & In Transit",
      "traditional": "Encryption applied inconsistently, mostly in transit only",
      "advanced": "Encryption enforced by policy across most data stores and channels",
      "optimal": "End-to-end encryption with centralized key management and rotation",
      "frameworks": [
        {
          "framework": "PCI-DSS v4.0",
          "ref": "3.5 / 4.2"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.15"
        }
      ]
    },
    {
      "id": "data-key-management",
      "pillar": "Data",
      "capability": "Key Management / HSM",
      "traditional": "Software-based key storage; manual rotation",
      "advanced": "Centralized KMS/HSM with policy-based rotation",
      "optimal": "Hardware-backed, automated key lifecycle management with real-time revocation",
      "frameworks": [
        {
          "framework": "PCI-DSS v4.0",
          "ref": "3.6"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.15"
        }
      ]
    },
    {
      "id": "data-residency",
      "pillar": "Data",
      "capability": "Data Residency & Sovereignty Controls",
      "traditional": "No enforcement of data location",
      "advanced": "Policy-based data residency enforcement for regulated data",
      "optimal": "Automated, continuously verified data residency compliance across all storage and processing locations",
      "frameworks": [
        {
          "framework": "GLBA (Safeguards Rule)",
          "ref": "16 CFR 314.4(c)"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.03"
        }
      ]
    },
    {
      "id": "device-firmware-integrity",
      "pillar": "Device",
      "capability": "Firmware & Supply Chain Integrity",
      "traditional": "No firmware or hardware supply-chain attestation",
      "advanced": "Periodic firmware/BIOS integrity checks",
      "optimal": "Continuous hardware-rooted supply-chain attestation at every boot/session",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "SR-11"
        }
      ]
    },
    {
      "id": "device-health-attestation",
      "pillar": "Device",
      "capability": "Device Health Attestation",
      "traditional": "No attestation; trust based on network location",
      "advanced": "Agent-based posture checks (patch level, disk encryption) gate access",
      "optimal": "Hardware-rooted attestation (TPM) continuously verified per session",
      "frameworks": [
        {
          "framework": "NIST 800-207",
          "ref": "Sec 3.3"
        }
      ]
    },
    {
      "id": "device-inventory",
      "pillar": "Device",
      "capability": "Device Inventory & Compliance",
      "traditional": "Manual asset spreadsheets, periodic audits",
      "advanced": "Automated MDM/EDR-based inventory with compliance scoring",
      "optimal": "Real-time device trust scoring feeding dynamic access decisions",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "CM-8"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "12.5"
        }
      ]
    },
    {
      "id": "device-vendor-risk",
      "pillar": "Device",
      "capability": "Third-Party & Vendor Device Risk",
      "traditional": "No visibility into vendor/contractor device posture",
      "advanced": "Vendor devices required to enroll in MDM or pass a posture check before access",
      "optimal": "Continuous vendor device risk scoring integrated into access decisions",
      "frameworks": [
        {
          "framework": "NYDFS 500",
          "ref": "500.11"
        },
        {
          "framework": "GLBA (Safeguards Rule)",
          "ref": "16 CFR 314.4(f)"
        }
      ]
    },
    {
      "id": "network-dr-resilience",
      "pillar": "Network & Environment",
      "capability": "Disaster Recovery & Resilience Architecture",
      "traditional": "Manual failover; infrequent DR testing",
      "advanced": "Automated failover with regular DR testing",
      "optimal": "Continuously validated, automated multi-region resilience with real-time failover",
      "frameworks": [
        {
          "framework": "NYDFS 500",
          "ref": "500.16"
        },
        {
          "framework": "FFIEC IT Handbook",
          "ref": "Business Continuity"
        }
      ]
    },
    {
      "id": "network-encrypted-traffic",
      "pillar": "Network & Environment",
      "capability": "Encrypted Traffic Inspection",
      "traditional": "Limited visibility into encrypted traffic",
      "advanced": "TLS inspection at key chokepoints",
      "optimal": "Full encrypted-traffic analytics without decryption (metadata/ML-based)",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "SC-8"
        }
      ]
    },
    {
      "id": "network-macrosegmentation",
      "pillar": "Network & Environment",
      "capability": "Network Segmentation",
      "traditional": "Perimeter firewall, flat internal network",
      "advanced": "Macro-segmentation by zone/environment with internal firewalls",
      "optimal": "Software-defined micro-perimeters enforced per session, no implicit trust zones",
      "frameworks": [
        {
          "framework": "NIST 800-207",
          "ref": "Sec 3.4"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "1.2"
        }
      ]
    },
    {
      "id": "network-third-party-connectivity",
      "pillar": "Network & Environment",
      "capability": "Third-Party Network Connectivity Controls",
      "traditional": "Static VPN or leased-line trust for partners",
      "advanced": "Segmented, policy-scoped partner connectivity (ZTNA for B2B)",
      "optimal": "Dynamic, risk-based partner network access with continuous session verification",
      "frameworks": [
        {
          "framework": "NYDFS 500",
          "ref": "500.11"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "1"
        }
      ]
    },
    {
      "id": "user-identity-federation",
      "pillar": "User",
      "capability": "Identity Federation & Single Sign-On",
      "traditional": "Local identity stores per application",
      "advanced": "Centralized IdP with federated SSO across most applications",
      "optimal": "Unified identity fabric with just-in-time, attribute-based access across all environments",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "IA-8"
        },
        {
          "framework": "SOX (ITGC)",
          "ref": "Access Management"
        }
      ]
    },
    {
      "id": "user-mfa",
      "pillar": "User",
      "capability": "Multi-Factor Authentication",
      "traditional": "Password-only or basic MFA (SMS/OTP) at network login",
      "advanced": "Phishing-resistant MFA (FIDO2/PKI) enforced at app and privileged-session level",
      "optimal": "Continuous, risk-adaptive authentication using behavioral and contextual signals",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "IA-2"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "8.4"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.12"
        }
      ]
    },
    {
      "id": "user-pam",
      "pillar": "User",
      "capability": "Privileged Access Management (PAM)",
      "traditional": "Shared admin accounts; standing privileged access",
      "advanced": "PAM vault with just-in-time checkout and session recording for privileged accounts",
      "optimal": "Zero standing privilege; automated privileged-session analytics with anomaly-based revocation",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "AC-6"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.7"
        },
        {
          "framework": "PCI-DSS v4.0",
          "ref": "7"
        }
      ]
    },
    {
      "id": "user-sod",
      "pillar": "User",
      "capability": "Segregation of Duties (SoD) Enforcement",
      "traditional": "Manual SoD review during periodic audits",
      "advanced": "Automated SoD conflict detection in IAM/ERP systems",
      "optimal": "Continuous, real-time SoD enforcement blocking conflicting access at request time",
      "frameworks": [
        {
          "framework": "SOX (ITGC)",
          "ref": "Access Management"
        },
        {
          "framework": "NIST 800-53",
          "ref": "AC-5"
        }
      ]
    },
    {
      "id": "visibility-insider-threat",
      "pillar": "Visibility & Analytics",
      "capability": "Insider Threat Program",
      "traditional": "Reactive investigation only, after the fact",
      "advanced": "UEBA-driven insider risk scoring with defined triggers",
      "optimal": "Continuous, cross-pillar insider risk analytics feeding automated response",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "PM-12"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.14"
        }
      ]
    },
    {
      "id": "visibility-siem",
      "pillar": "Visibility & Analytics",
      "capability": "Centralized Logging & SIEM",
      "traditional": "Siloed logs, manual review",
      "advanced": "Centralized SIEM with correlation rules across most systems",
      "optimal": "Behavioral analytics (UEBA) with automated risk scoring feeding policy decisions",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "AU-6"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.14"
        },
        {
          "framework": "SOX (ITGC)",
          "ref": "Monitoring"
        }
      ]
    },
    {
      "id": "visibility-third-party-risk",
      "pillar": "Visibility & Analytics",
      "capability": "Third-Party & Fourth-Party Risk Visibility",
      "traditional": "Point-in-time vendor assessments",
      "advanced": "Continuous vendor security posture monitoring (ratings services)",
      "optimal": "Real-time vendor and subcontractor (fourth-party) risk visibility integrated into access and data-sharing decisions",
      "frameworks": [
        {
          "framework": "GLBA (Safeguards Rule)",
          "ref": "16 CFR 314.4(f)"
        },
        {
          "framework": "NYDFS 500",
          "ref": "500.11"
        }
      ]
    },
    {
      "id": "visibility-threat-intel",
      "pillar": "Visibility & Analytics",
      "capability": "Threat Intelligence Integration",
      "traditional": "Ad hoc, manual threat feed consumption",
      "advanced": "Automated ingestion into SIEM/SOAR for detection",
      "optimal": "Predictive analytics correlating threat intel with real-time access decisions",
      "frameworks": [
        {
          "framework": "NIST 800-53",
          "ref": "RA-3"
        }
      ]
    }
  ]
}