Map your security controls to MITRE ATT&CK with confidence

MITRE ATT&CK is a free, globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is maintained by MITRE, a US not-for-profit organisation. Tactics describe what an attacker is trying to achieve, such as initial access or exfiltration, while techniques and sub-techniques describe how they do it. Security teams use it as a common language for threats, detections and defensive controls.

ATT&CK v16 was released on 31 October 2024. Its biggest structural change was to cloud platforms: the Azure AD, Office 365 and Google Workspace platforms were removed from Enterprise ATT&CK and replaced by the broader Identity Provider and Office Suite platforms. The release also expanded detection notes and analytics. Enterprise v16 contains 14 tactics, 203 techniques, 453 sub-techniques and 44 mitigations.

No. MITRE ATT&CK is a voluntary framework and there are no penalties for not using it. It is not a law, regulation or certifiable standard. However, customers, cyber insurers and security assessors increasingly ask organisations how their defences map to known attacker techniques, and ATT&CK is the most common reference for answering that question.

No. There is no ATT&CK certification for organisations and MITRE does not audit companies against it. Instead, organisations use ATT&CK to measure detection and prevention coverage, plan red team and penetration testing exercises, and prioritise controls. If you need a certificate to show customers, pair ATT&CK with a certifiable standard such as ISO 27001 or an attestation such as SOC 2.

They complement each other. ISO 27001 and SOC 2 define the controls and management system an organisation should operate, while ATT&CK describes the attacker behaviour those controls should defend against. Mapping your ISO 27001 or SOC 2 controls to ATT&CK techniques shows which threats you already address and where gaps remain, helping you prioritise improvements with a threat-informed view.

In v16, the 14 Enterprise tactics are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Each tactic groups the techniques attackers use to reach that goal, and each has an identifier beginning with TA, such as TA0001 for Initial Access.

No. MITRE typically publishes major ATT&CK releases twice a year, and several versions have followed v16. Later releases have restructured parts of the framework, for example v19 split the Defense Evasion tactic into new tactics. Many tools and control mappings still reference v16, so it remains a common baseline, but check MITRE's updates page for the current version.

Yes. OneClickComply supports MITRE ATT&CK v16 today, linking ATT&CK techniques to the controls you already operate. Evidence you collect for frameworks such as ISO 27001 or SOC 2 counts towards your ATT&CK coverage view, and continuous monitoring shows whether those controls keep working.