Read this before you use any of it.
This Isn't Legal, Regulatory, or Compliance Advice. Nothing here creates a professional relationship, and none of it replaces advice from a lawyer or a licensed professional where you are.
Fiction Is Analogy, Not Evidence. The fiction collections exist to make a point land in training. Nothing in them is a case study, a control test, or something to cite in an audit response. If you cite a Simpsons episode to a regulator, that is between you and the regulator.
Verify the Real Ones. The incident collections describe real events, compiled for teaching. Dates, figures, and details were checked casually, not forensically. Before anything formal, a report, a filing, a slide with your firm's logo on it, verify against primary sources.
The Mappings Are Illustrative. NIST and ISO tags are a lookup so you can find the right story fast. They are not a crosswalk, an assessment, or an authority.
The Stories Belong to Their Owners. Short descriptive references for education and commentary, under the names of works their creators own. Nothing here grants you any rights to the underlying works.
No Warranty. As-is. No promises, express or implied. I'm not liable for what happens when you use it.
Nothing Here Comes from a Client Engagement. All of it is built independently from general professional knowledge. No client, employer, or engagement-specific information appears anywhere in this repository.