Daily Security News
Aboutmerill.net
Security adoption framework and CISO workshop
Standards and frameworks

Security standards and frameworks

6 November 2026New+95 / −0 lines

In brief

Added Microsoft security guidance documentation in security-docs/zero-trust/security-standards-and-frameworks.md.

What security teams need to know

Review the underlying documentation change to determine whether it affects tenant configuration or rollout plans.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: Security standards and frameworks | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/security/zero-trust/security-standards-and-frameworks uhfHeaderId: MSDocsHeader-Security breadcrumb_path: /security/breadcrumb/toc.json feedback_system: Standard feedback_help_link_type: '' ms.author: mas author: MarkSimos description: Learn how to use the Microsoft Security Adoption Framework (SAF) to align security work with security standards and frameworks and connect it to practical security guidance and technology implementation. ms.date: 2026-11-06T00:00:00.0000000Z ms.service: security ms.subservice: zero-trust ms.topic: concept-article locale: en-us document_id: 6e354630-7374-0fb4-27ca-81358a98fff9 document_version_independent_id: 6e354630-7374-0fb4-27ca-81358a98fff9 original_content_git_url: https://github.com/MicrosoftDocs/security-pr/blob/live/security-docs/zero-trust/security-standards-and-frameworks.md site_name: Docs depot_name: MSDN.security-docs page_type: conceptual toc_rel: toc.json pdf_url_template: https://learn.microsoft.com/pdfstore/en-us/MSDN.security-docs/{branchName}{pdfName} feedback_product_url: '' feedback_help_link_url: '' asset_id: zero-trust/security-standards-and-frameworks moniker_range_name: monikers: [] item_type: Content source_path: security-docs/zero-trust/security-standards-and-frameworks.md cmProducts:

Security standards and frameworks | Microsoft Learn

Security standards and frameworks help organizations define security objectives, practices, and requirements. The Microsoft Security Adoption Framework (SAF) helps translate these standards and frameworks into coordinated security work across business, technology, and security roles and connects that work to technology implementation.

This guidance helps organizations understand how established security standards and frameworks relate to SAF and Microsoft security technologies. The framework mappings provide more detailed alignment where available.

Organizations can use this guidance and the mappings to:

  • Translate standards and framework objectives into actionable security work. Connect objectives, practices, and requirements to SAF security disciplines, roles, and responsibilities.
  • Plan and implement security improvements. Identify relevant security capabilities, technologies, implementation guidance, and Microsoft products that can help address framework objectives and organizational priorities.
  • Coordinate work across business, technology, and security teams. Provide shared context for planning, architecture, implementation, operations, and security oversight.
  • Assess progress and communicate alignment. Relate security improvements and implemented capabilities back to the objectives and requirements of the standard or framework.

These mappings help organizations apply standards and frameworks using SAF and Microsoft security technologies. They don't replace authoritative standards, frameworks, or requirements, and they don't by themselves demonstrate compliance.

Zero Trust

Zero Trust provides the security principles that underpin SAF. SAF helps organizations apply these principles across business decisions, security practices, technology design, implementation, and operations.

Use these resources to understand Zero Trust and connect it to SAF:

Framework mappings

Use these mappings to connect objectives from established security frameworks and strategies to SAF guidance, security capabilities, technology implementation, and relevant Microsoft product guidance. This helps organizations align security work with framework objectives and requirements.

CISA Zero Trust Maturity Model

Use the CISA Zero Trust Maturity Model overview to connect CISA Zero Trust capabilities and maturity objectives to SAF guidance, technologies, and related Microsoft implementation guidance.

DoD Zero Trust Strategy

Use the DoD Zero Trust Strategy overview to connect DoD Zero Trust capabilities and activities to SAF guidance, technologies, and related Microsoft implementation guidance.

Use a standard or framework as a SAF starting point

The mappings show how objectives, practices, and requirements from standards and frameworks connect to SAF guidance and technology implementation. You can also use a standard or framework as a practical starting point for security adoption. This approach is useful when your organization already uses a framework, must meet specific requirements, or wants to use an established framework to structure security improvements.

To use a standard or framework as a SAF starting point:

  1. Identify relevant objectives, practices, or requirements from the standard or framework.
  2. Connect them to SAF guidance and security disciplines to understand the security work needed.
  3. Identify the technologies that you must protect and the roles involved.
  4. Identify implementation options by using relevant technical solutions and Microsoft product guidance.
  5. Assess progress and alignment against organizational outcomes and applicable framework or standard objectives.

Standards and frameworks can provide important structure and requirements for security programs, but alignment or compliance alone doesn't define security success. SAF helps organizations connect framework-driven work to broader security outcomes, strategy, architecture, implementation, and operations.

Related SAF guidance