A modern security doctrine
CyberBushido
A security doctrine for how practitioners behave when the controls stop being enough.
- Virtues
- 8
- Practices
- 160
- 17 mappings
- NIST CSF 2.0
- 26 mappings
- ISO 27001
- Assessment questions
- 24
The model
From virtue to evidence.
Every virtue resolves, in steps a practitioner can check, into something an auditor would recognise.
- 01VirtueEight principles, each argued in full.
- 02BehaviourWhat a practitioner actually does.
- 03PracticeTwenty per virtue, in four maturity bands.
- 04ControlNIST CSF 2.0 and ISO 27001:2022.
- 05EvidenceWhat would show the practice is real.
- 06AssessmentTwenty-four questions. A mirror.
The eight virtues
Eight virtues. Real security outcomes.
Each virtue names a behaviour. Each behaviour becomes practices you can check, and controls you already answer to.
The stance
Four disciplines. One practitioner.
The virtues say who the practitioner is. Kamae says how they engage: perceive, analyse, protect, remain aware.
- Metsuke 目付Perceive
- Katana 刀Analyse
- Tate 盾Protect
- Zanshin 残心Remain aware
Why it matters
Security is a practice of character before it is a checklist. The eight virtues of Bushido — an ethical code, read honestly, with its seams shown — give that character a vocabulary: eight commitments, each resolving to controls a practitioner already answers to. This site makes the argument, maps it to NIST CSF 2.0 and ISO 27001:2022, and hands you a mirror.
Security controls define what an organisation can enforce. Character defines what people do when the control does not cover the situation.
From doctrine to practice
From principle to practice. From practice to recognised controls.
- 01Virtue
- 02Behaviour
- 03Practice
- 04Control
- 05Evidence
- 06Assessment
| Virtue | Practice | NIST CSF 2.0 | ISO 27001 |
|---|---|---|---|
| 義Gi | Name the decision owner | PR.DS-01 | A.8.24 |
| 礼Rei | Define access requirements | PR.AA-05 | A.5.15 |
| 自制Jisei | Define change classes | PR.PS-01 | A.8.32 |
Assess your practice
A reflective assessment in 24 questions.
Understand where your practice is strong, and where to focus next.
- 24 statements about what your team actually does
- Mapped to the eight virtues
- Linked to recognised controls
- Practical next steps, by maturity band