MRISMythos-Resistant Information Security
DEEN

Changes · Website and publications

What's new

New editions of the analyses, Implementation Guides and modules as well as new pages of the website, with dates.

Recent changes

  1. Website

    Redesign of the website with findings board, analysis matrix, MHC catalog and publication register. New pages: a page for every Mythos Hardening Control (MHC-01 to MHC-16), a briefing on Claude Mythos, seven gaps in ISO/IEC 27002, eight finding patterns in TISAX®, a regulatory mapping, the roadmap, a glossary and this change page.

  2. MRIS.bd 2.0

    Module family for IT-Grundschutz: five custom modules with 23 requirements, implementation guidance, cross-reference table and machine-readable edition.

  3. MRIS for ISO/IEC 27001 and MRIS for TISAX® 2027, edition 2.0

    Quality release after external review (expert review, leadership perspective, audit logic), binding reading of the maturity levels (Initial does not evidence implementation) and control statements of all MHC synchronized to the Defined level.

Version history MRIS for ISO/IEC 27001

The first sentence of each change log entry; the complete version notes are in the PDF.

VersionDateChange (excerpt)
2.0August 2026Quality release after an external quality, CISO and audit review.
1.13August 2026Clarification of the ISO linkage in Chapter 9.2: where the finding cell names only the primary anchor controls, this is now marked as a selection ("primarily flanks") with a reference to the complete mapping in Annex A.
1.12August 2026PQC key management deepened (source: CSA Cloud Key Management Working Group, draft 08/2026; own wording with attribution).
1.11August 2026Implementation of the external technical review (Daniel Heldt) of version 1.8.
1.10August 2026Condensation for manageability (extent significantly reduced) without loss of substance at the core.
1.9August 2026External evidence update (pass-the-passkey attack class, SpecterOps, August 2026; a classic implementation and endpoint weakness, no control reclassification).
1.8July 2026Multi-vendor update (response to review trigger a): new Chapter 2.5 (Daybreak, MDASH, general availability of the Mythos class, disclosure waves); "Mythos" as a class term; MHC-02, MHC-09 and MHC-12 sharpened multi-systemically; new Chapter 11.4 threat horizon; gate criteria for MHC-04 and MHC-07 in Chapter 10.6; reference clean-up (Mythos-Ready dating, TR-03183, access date per web source); machi
1.7July 2026Consistency release after an external dual assessment (auditor and CISO): mapping in Chapter 9.4 harmonized with Annexes A and C (Annex A authoritative; A.8.4, A.8.27, A.5.9); annex references to E and G corrected; MHC count consistently "thirteen"; two new metrics (container policy conformity, agent inventory coverage) in Chapter 10.6 and Annex G; process shell clarification for friction controls
1.6June 2026Reference update without substantive reassessment of the controls.
1.5April 2026Sharpening of the classification language and the effectiveness statements after a critical audit assessment.
1.4April 2026Closure of the structural gaps identified by the audit assessment ("completeness = medium").
1.3April 2026Coverage extension relative to the CSA/SANS/OWASP report "Building a Mythos-ready Security Program" (April 2026).
1.2April 2026Concretization of the hardening recommendations for audit robustness.
1.1April 2026Revised edition for audit robustness.
1.0April 2026First publication.

Source: MRIS for ISO/IEC 27001, edition 2.0 (PDF), CC BY-SA 4.0. (version notes) Chapter references in the text refer to the respective PDF edition.