Research bibliography¶
What's on this page
- Named frameworks used to raise documentation quality
- Notes on how we use them (themes, not verbatim standards text)
What this enables
- Traceability of “enterprise-grade” claims to recognized practice
- Faster onboarding for GRC and security reviewers
Frameworks and practice areas¶
| Area | References (public) |
|---|---|
| Security program structure | NIST Cybersecurity Framework 2.0 |
| Incident response | NIST SP 800-61 Rev. 2 themes |
| Information security management | ISO/IEC 27001 Annex A control themes |
| Privacy | GDPR principles; CCPA/CPRA consumer rights themes |
| Application security | OWASP ASVS / SAMM themes |
| Supply chain | SLSA conceptual levels |
| Reliability | Google SRE book themes (error budgets, toil) — high level |
| SaaS finance | Rule of 40; LTV/CAC; payback period practices |
| Org design | Matrix org; dual-track IC ladders; DACI/RACI |
| Docs-as-code | MkDocs Material; mike multi-version publishing |
| Commits / PRs | Conventional Commits; linear history practices |
Not certification
Mapping themes does not mean Inkorporated or any deployment is certified against ISO, SOC 2, or similar. Use these docs as an operating system template and engage qualified auditors/counsel for attestations.