Cybersecurity Certification Options

ComplianceForge documentation supports a wide variety of cybersecurity compliance efforts. The Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP) enables organizations to demonstrate compliance with laws, regulations, and frameworks where existing certifications don't exist.

Banner ComplianceForge SCF Licensed Content Provider

Key Takeaways - Certification Options

ComplianceForge documentation has been successfully used for CMMC, PCI DSS, ISO 27001, SOC 2, HIPAA, FedRAMP, FISMA, and many more compliance certifications.
The Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP) is a new approach to certification, enabling third-party assessments where no prior certification path existed.
The Cyber AB (same accreditation body the DoD uses for CMMC) is the SCF's accreditation body for the SCR CAP.
The SCR CAP roadmap covers 18 certifications including NIST CSF 2.0, HIPAA, NIS2, DORA, GLBA, NIST 800-171, and more.
The metaframework nature of the SCF enables a single assessment to span multiple laws, regulations, and frameworks simultaneously.

Proven Documentation for Compliance

Cybersecurity Compliance Starts With Unambiguous Documentation

ComplianceForge documentation is designed to scale for any cybersecurity or data privacy compliance need. Our clients have successfully used ComplianceForge documentation for a wide variety of compliance efforts, including:

NIST 800-171 / Cybersecurity Maturity Model Certification (CMMC);
Payment Card Industry Data Security Standard (PCI DSS);
ISO 27001;
System and Organization Controls (SOC 2);
Health Insurance Portability and Accountability Act (HIPAA) / Health Information Technology for Economic and Clinical Health Act (HITECH);
Federal Risk and Authorization Management Program (FedRAMP);
Federal Information Security Modernization Act (FISMA) ;
Risk Management Framework (RMF) / DoD Information Assurance Certification and Accreditation Process (DIACAP);
Criminal Justice Information Services (CJIS);
Family Educational Rights and Privacy Act (FERPA);
Internal Revenue Service (IRS) 1075;
European Union General Data Protection Regulation (EU GDPR);
Gramm-Leach-Bliley Act (GLBA);
Sarbanes–Oxley Act (SOX);
Federal Financial Institutions Examination Council (FFIEC);
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) ;
New York Department of Financial Services (23 NYCRR 500);
And more!

There are a lot of cybersecurity and data privacy compliance requirements, but only a fraction have the ability to earn a certification. To address the needs of businesses that want to demonstrate compliance via a third-party assessment, the Secure Controls Framework (SCF) developed a conformity assessment methodology. The Cyber AB (same accreditation body as the DoD uses for CMMC) is the SCF's accreditation body for the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP).

A New Approach to Certification

Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP)

The Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP) is a new approach to cybersecurity certifications, since it enables an organization to demonstrate compliance with a law, regulation or framework, where an existing certification does not exist (e.g., NIST CSF 2.0 certification). The SCR CAP is designed for cybersecurity & privacy practitioners by cybersecurity & data privacy practitioners. This concept is based on the need within the industry for a tailored conformity assessment solution that is capable of addressing several key considerations:

View compliance as a natural by-product of secure practices;
Scale to address multifaceted operational requirements (e.g., laws, regulations and frameworks);
Acknowledge the stated risk tolerance of the OSC since not all organizations have the same risk tolerance;
Minimize the risk of “gaming” the certification process that provides no useful insights into the security posture of the Organization Seeking Certification (OSC);
Utilize technology to make the assessment process more efficient to drive down labor-related assessment costs; and
Leverage existing industry recognized practices, where possible.

The SCR CAP is designed to utilize tailored cybersecurity and data privacy controls to specifically address the applicable statutory, regulatory and contractual obligations an organization needs to comply with. The metaframework nature of the SCF enables an organization to perform a conformity assessment that can span multiple cybersecurity and data privacy-specific laws, regulations and frameworks.

Efficient & Cost-Effective Certification

SCR CAP Certification Roadmap

The SCR CAP has a roadmap to enable the following SCF-based certifications.

Australia Essential Eight;
Canada B-13;
Department of Homeland Security (DHS) Zero Trust Capability Framework (ZTCF);
DHS Cybersecurity & Infrastructure Security Agency (CISA) Secure Software Development Attestation Form;
EU Digital Operational Resilience Act (DORA);
ENISA NIS2 (Directive (EU) 2022/2555);
Federal Acquisition Regulation (FAR) 52.204.21;
Gramm Leach Bliley Act (GLBA) - CFR 314;
New Zealand Health Information Security Framework 2022;
NIST Cybersecurity Framework (NIST CSF) 2.0;
NIST SP 800-66 R2 (HIPAA Secure Rule);
NIST SP 800-161 R1 (C-SCRM baseline);
NIST SP 800-171 R2 (non-CMMC);
NIST SP 800-171 R3 (non-CMMC);
NIST SP 800-207 (zero trust principles);
NY DFS 23 NYCRR500 - 2023 Amendment 2;
Secure Code Alliance (SCA) Secure Software Development Practices (SSDP); and
Trusted Information Security Assessment Exchange (TISAX) Information Security Assessment (ISA).

Common Questions

Frequently Asked Questions (FAQs)

Here are answers to the questions people ask most when comparing certification options:

How can you get certified against a framework that has no official certification?

You can pursue a third-party conformity assessment program built for that gap, such as the SCR Conformity Assessment Program (SCR CAP). Only a fraction of cybersecurity and data privacy requirements offer a certification, and neither NIST nor HHS certifies organizations against the NIST Cybersecurity Framework or the HIPAA Security Rule. Under the SCR CAP, an accredited SCR 3PAO assesses an organization against Secure Controls Framework (SCF) controls mapped to the requirement, and a successful assessment earns an SCR Certified designation.

Has ComplianceForge documentation been used for CMMC, ISO 27001 and SOC 2?

Yes, ComplianceForge clients have used our documentation for CMMC, PCI DSS, ISO 27001, SOC 2, HIPAA, FedRAMP and FISMA efforts, among many others. Our documentation doesn't grant a certification on its own. It gives you the written policies, standards and procedures that assessors and auditors review as evidence. When requirements overlap, one documentation set can support several compliance efforts at once, which cuts down on duplicate writing across programs.

Does ComplianceForge issue cybersecurity certifications?

No, ComplianceForge doesn't issue certifications. We provide documentation and gap assessment services that help you prepare for certification, but the certification itself comes from an independent assessor. Under the SCR CAP, third-party conformity assessments are performed by SCR Third-Party Assessment Organizations (3PAOs) accredited by The Cyber AB. We work with StrikePath as a recommended 3PAO, and we can support you from the initial gap assessment through the third-party assessment.

Can one assessment cover multiple cybersecurity frameworks at once?

Yes, the SCR CAP is built to do that. Because the Secure Controls Framework (SCF) is a metaframework that maps to more than 200 laws, regulations and frameworks, an organization can be assessed against one set of SCF controls that covers several obligations in a single engagement. The SCF offers a tailored SCR certification for a custom control set, alongside certifications aimed at a single requirement such as NIST CSF 2.0.

What certifications are on the SCR CAP roadmap?

The SCR CAP roadmap lists 18 SCF-based certifications. They include NIST CSF 2.0, the HIPAA Security Rule through NIST SP 800-66 R2, NIST SP 800-171 R2 and R3 outside of CMMC, NY DFS 23 NYCRR 500, EU DORA, NIS2, GLBA, Australia Essential Eight and TISAX. Several roadmap items, including NIST CSF 2.0, the HIPAA Security Rule, NY DFS 23 NYCRR 500 and NIST SP 800-171 R3, are now listed as available on the Secure Controls Framework website.