SCF — Secure Controls Framework

Why does it matter?

The SCF solves a specific problem: an organization that must satisfy ISO/IEC 27001, SOC 2, NIST SP 800-53, PCI DSS and a privacy law at the same time otherwise ends up with five overlapping control lists, five sets of evidence requests and five audits testing the same thing. By mapping all of those requirements to one catalog of more than 1,500 controls, the SCF lets a compliance team implement and test a control once and cite it to every regime that requires it. Because the license is Creative Commons Attribution-NoDerivatives 4.0 and the catalog is published in Excel and OSCAL, it can be loaded into a GRC platform without a purchase, and the quarterly releases add new mappings when a new law or framework appears.

Key benefits include:

• One control set, many obligations

More than 1,500 controls in 34 domains carry STRM crosswalks to over 250 laws, regulations and frameworks, so one implemented control serves every regime that maps to it.

• Transparent mappings

Since the 2024 releases every crosswalk uses Set Theory Relationship Mapping based on NIST IR 8477: each mapping states whether the SCF control is a subset of, equal to, a superset of, intersects with or has no relationship to the external requirement, with a strength score.

• Built-in maturity criteria

The SCR-CMM gives each control criteria for six levels, from Level 0 (Not Performed) to Level 5 (Continuously Improving), so target and actual maturity can be scored per control.

• Free and machine-readable

Released at no cost under CC BY-ND 4.0 in Excel/CSV and JSON (NIST OSCAL), with a legacy-to-current control number mapping carried inside the catalog after the 2026 Q3 renumbering.

• A path to certification

The SCR CAP, with the Cyber AB as accreditation body, lets an organization have an SCF-based control set assessed by an accredited third-party assessment organization and receive an SCF Certified designation.

How does it work?

The catalog is the core artifact. Its 34 domains run from Governance (GOV), Asset Management (AST), Identity & Access Control (IAC), Network Security (NET) and Cryptography (CRY) through Data Classification & Handling (DCH), Privacy (PRI), Risk Management (RSK), Compliance (CPL), Incident Response (IRO), Business Continuity & DR (BCD), Vulnerability & Patch Management (VPM) and Continuous Monitoring (MON) to Cloud Security (CLD), Third-Party Management (TPM), Secure Engineering & Architecture (SEA), Change Management (CHG), Threat Management (THR) and, since the 2026.2 release of July 7, 2026, Quantum Security (QTS). Each control is numbered within its domain, and most controls were renumbered in the 2026 Q3 release with the old numbers kept as a mapping column.

Mapping is done with Set Theory Relationship Mapping (STRM). For each pairing of an SCF control with a clause of an external law, regulation or framework, the mapping records one of five relationship types (Subset Of, Equal To, Superset Of, Intersects With, No Relationship) and a numeric strength score, following NIST IR 8477. The 2026.2 release completed published STRM for every mapped framework except the deprecated NIST SP 800-53 Rev. 4 and the SIG, whose mappings come from its own publisher. PDF versions of the STRM crosswalks are free; editable Excel versions are sold as a bundle. Risk and threat catalogs are also mapped to controls, with each pairing rated Likely, Possible or Unlikely since the 2026 Q3 release.

The supporting documents are free downloads from the same site: the Secure, Compliant & Resilient Management System (SCRMS) and its Prioritized Implementation Guide, the Risk Management Model (SCR-RMM), the Capability Maturity Model (SCR-CMM), the Cybersecurity & Data Protection Assessment Standards (CDPAS), the Unified Scoping Guide and an Evidence Request List. The SCR-CMM, built on the SSE-CMM v2.0 structure, defines Level 0 Not Performed, Level 1 Performed Informally, Level 2 Planned & Tracked, Level 3 Well Defined, Level 4 Quantitatively Controlled and Level 5 Continuously Improving, and each succeeding level builds on its predecessor. The 2026.2 release also added lists of compensating controls to many controls.

Key Elements

• Control catalog (34 domains, 1,500+ controls)

The domain-coded controls with descriptions, maturity criteria and crosswalks, released quarterly in Excel/CSV and JSON (OSCAL).

• Set Theory Relationship Mapping (STRM)

The NIST IR 8477 method behind every crosswalk: five relationship types plus a strength score, published for over 250 laws, regulations and frameworks.

• SCR-CMM maturity model

Six levels (0 to 5) of criteria per control, built on SSE-CMM v2.0, used to set target maturity and score current state.

• Risk and threat catalogs

Catalogs of risks and threats mapped to controls and rated Likely, Possible or Unlikely for each control (2026 Q3 release).

• Compensating controls and legacy mapping

Lists of compensating controls on many controls (2026.2) and a current-to-legacy control number mapping after the Q3 renumbering.

• SCR CAP

The Conformity Assessment Program accredited by the Cyber AB: examine, interview and test assessments by accredited 3PAOs leading to an SCF Certified designation for control sets such as NIST CSF 2.0, NY DFS Part 500, CMMC Level 1, the HIPAA Security Rule, NIST SP 800-171 R3 and SCF CORE Fundamentals.

What does it cover?

The SCF is sector-neutral and jurisdiction-neutral: it is used by any organization that must demonstrate cybersecurity or data protection controls to more than one authority, auditor or customer, and it can be adopted for a single business unit or an entire enterprise. It covers people, process, technology, data and facilities controls across the 34 domains, including privacy controls alongside security ones, and it reaches supplier and cloud relationships through the Third-Party Management and Cloud Security domains. It is not itself a law or a certifiable standard; conformity is voluntary unless an organization chooses an SCR CAP assessment, and the mappings do not change what the underlying laws require.

What are its objectives?

The SCF Council publishes the framework so that organizations can be secure, compliant and resilient with one control set rather than many.

Provide one common control catalog that satisfies overlapping cybersecurity and privacy obligations.

Make every crosswalk transparent and auditable through Set Theory Relationship Mapping.

Give each control objective maturity criteria so programs can be planned, budgeted and measured.

Keep the catalog current through quarterly releases as laws and frameworks change.

Offer an accredited route to certification against SCF-based control sets through the SCR CAP.

Framework in Context

The SCF sits beneath the frameworks it maps rather than competing with them: an organization still certifies to ISO/IEC 27001, obtains a SOC 2 report, meets NIST SP 800-53 or NIST SP 800-171 or demonstrates GDPR and HIPAA compliance, but implements and evidences the controls once through the SCF catalog. NIST's own SP 800-53, the CIS Controls, COBIT 2019 and the NIST Cybersecurity Framework 2.0 are among the sources it maps, and the SCF Council runs its crosswalks on the NIST IR 8477 method that NIST uses in its OLIR program. The SCR CAP, with the Cyber AB as accreditation body, gives the SCF an assessment layer comparable to other third-party assessment programs the Cyber AB oversees.

Common Framework Mappings

Organizations map the SCF to the frameworks below so that one control set, one evidence library and one test cycle serve every regime.

Mapped frameworks include:

CIS Controls v8.1

COBIT 2019

ISO 27001:2022

ISO 27002:2022

MITRE ATT&CK

NIST CSF 2.0

NIST 800-53 Rev.5

SOC 2