# SP-009 Generic Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Foundational reference pattern illustrating how NIST 800-53 control families map to a generic computing architecture of clients, servers, and networks. Serves as the conceptual baseline from which all other OSA security patterns are derived.
Use when: Use the Generic Pattern as a starting point when designing security architecture for any new system or environment, before selecting more specific patterns. Valuable for training and education: it provides security architects with a mental model for where different control families apply in any computing architecture.
Not when: The Generic Pattern should not be used as a standalone security architecture for any real-world system.

## Threats and the controls that mitigate them (10)
- T-GP-001 Client Endpoint Compromise (Malware, Ransomware): 
- T-GP-002 Credential Theft and Unauthorised Authentication: 
- T-GP-003 Network Interception and Man-in-the-Middle: 
- T-GP-004 Denial of Service (Network and Application Layer): 
- T-GP-005 Lateral Movement Across Network Segments: 
- T-GP-006 Privilege Escalation on Host Systems: 
- T-GP-007 Data Breach via Application-Layer Exploitation: 
- T-GP-008 Configuration Drift and Security Baseline Degradation: 
- T-GP-009 Insider Threat (Malicious or Negligent): 
- T-GP-010 Supply Chain Compromise of System Components: 

## More
- Every control and what it mitigates, as JSON: /api/v1/patterns/SP-009/crosswalk
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-009/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 17 KB: /api/v1/patterns/SP-009
- Page for people: /patterns/sp-009/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-001 Client Module; SP-002 Server Module; SP-008 Public Web Server Pattern; SP-011 Cloud Computing Pattern; SP-016 DMZ Module; SP-018 Information Security Management System

This card, the API and the page are generated from one file. Checking one against another adds no evidence.