A model is an incomplete representation of reality that makes certain aspects, mechanisms or relationships clear; a good model reduces complexity, explains, structures and orders. Many standards are models too, so they also show reality only incompletely.

* A model keeps what its purpose needs and drops the rest on purpose. The danger is forgetting what was dropped. *

The incompleteness is deliberate: a model leaves out what does not matter for its purpose, and that is exactly what makes it useful. A subway map is useless for walking distances and excellent for changing trains.

The consequence for cyber security architecture: when you apply a standard such as the ISO/OSI model or ISO 27001, remember that it covers some aspects of a real system well and ignores others. Treating a standard as a complete description of the system is how gaps go unnoticed.

Go deeper:

• All models are wrong — Wikipedia — George Box's "all models are wrong, but some are useful": judge a model by its usefulness, not by completeness.
• Map–territory relation — Wikipedia — Korzybski's "the map is not the territory", the classic warning against mistaking a model for reality.

The ISO/OSI reference model (a model that became a norm, 1983), ISO 27001 (a norm from the ISO 27000 family, 2005, revised 2013 and 2022) and the OWASP Top 10 (a quasi-standard, updated irregularly).

* Three standards, three kinds of status. The dots are editions, and all three are still in use today. *

The difference in status matters in practice: an ISO norm can be audited and certified against; the OWASP Top 10 is a widely accepted reference, not a formal norm. Its editions came at irregular intervals, from the first list in 2003 to the 2025 edition.

Go deeper:

• ISO/IEC 27001 — Wikipedia — the three editions and how certification audits by independent bodies work.
• OWASP — Wikipedia — the non-profit behind the Top 10, and why regulators and PCI DSS cite a list that is not a formal norm.