attackless.com
Our practical notes on security controls, priorities and evidence now live on the blog.