Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The Microsoft Security Adoption Framework (SAF) builds on established Microsoft security guidance rather than replacing it. SAF provides the adoption structure that connects business outcomes, roles, security disciplines, technologies, and technical solutions.
Existing guidance relates to SAF in three ways:
- Integrated into SAF: Relevant concepts or guidance are incorporated into SAF. Start with the corresponding SAF content.
- SAF-aligned experience: The resource helps stakeholders apply SAF through facilitated planning, assessment, or decision-making.
- Companion guidance: The resource remains independent and provides specialized depth for architecture, engineering, implementation, or operations.
The relationships in this article identify useful reading and implementation paths. They aren't compliance mappings or statements of equivalence.
Guidance mapping
| Existing Microsoft guidance | Where it fits in SAF | Relationship to SAF |
|---|---|---|
| CISO workshop | Strategy, integration, and governance | Integrated component of SAF. Provides strategy, program, and governance guidance for security leaders. |
| Microsoft Cybersecurity Reference Architectures (MCRA) | Security architecture | Integrated component of SAF. Provides reference architectures and technical planning guidance across security disciplines and technologies. |
| Immutable Laws of Security | Security architecture and security disciplines | Integrated component of SAF. Provides durable security design principles used to inform and validate security decisions. |
| Privileged access guidance | Access and identity | Integrated component of SAF. Provides guidance for protecting privileged access, including privileged access workstations and related controls. |
| Microsoft Security Development Lifecycle (SDL) | Development security | Complements SAF. Provides deeper engineering practices and lifecycle guidance for secure development. |
| Incident-response playbooks | Security operations (SecOps) | Integrated component of SAF. Provides operational guidance for preparing for and responding to security incidents. |
| SAF workshops | Multiple security disciplines | Integrated component of SAF. Provides facilitated planning, stakeholder alignment, decision-making, and roadmap development across multiple SAF disciplines. |
| Zero Trust assessment | Technologies and technical solutions | Complements SAF. Helps organizations assess and improve implementation of Zero Trust technology controls. |
Use the mapping
Integrated components such as the CISO workshop, MCRA, privileged access guidance, the Immutable Laws of Security, and incident-response playbooks contribute directly to SAF disciplines and guidance. Other resources, such as SDL and the Zero Trust assessment and workshops, complement SAF with deeper engineering, assessment, and implementation guidance.
Use these resources as part of an integrated security program rather than as separate or competing frameworks. SAF provides the organizing model that connects this guidance to business outcomes, security disciplines, technologies, roles, and implementation.