Key Takeaways - SCF Policies & Standards Template
- The SCRP is ComplianceForge's enterprise-class SCF-based policies, control objectives, standards, guidelines, metrics and more.
- Provides complete coverage for all SCF controls with 1-1 mapping. Policies to domains, standards to individual controls.
- 34 policy domains covering the full breadth of cybersecurity and data privacy requirements.
- Available in Word and Excel formats for stand-alone use or GRC platform import.
- Goes beyond just policies. Includes maturity criteria, threat catalog, risk catalog and more.
- Used by Fortune 500 companies, government agencies, universities and organizations with complex compliance needs.
- Delivered same-day. Saving hundreds of hours and tens of thousands of dollars vs writing from scratch.
OverviewWhat Is The Security, Compliance & Resilience Program (SCRP)?
The Security, Compliance & Resilience Program (SCRP) has complete coverage for the Secure Controls Framework (SCF). The SCRP is an enterprise-class solution for cybersecurity & data privacy documentation consisting of thirty-four (34) domains that defines a modern, digital security program. Specifically:
The SCRP leverages the Secure Controls Framework (SCF), which is a metaframework that maps to over 200 cybersecurity & data privacy laws, regulations and frameworks. The SCF's integration into the SCRP provides mapped risks, threats, maturity criteria and much more to make it the most robust solution on the market!
The SCRP's policies & standards have direct, 1-1 mapping to the SCF's controls. The SCRP leverages several key SCF components to provide “more than just policies & standards” by incorporating maturity criteria, a threat catalog, a risk catalog and more!
What Problems Are THere?What Problems Does The SCF Policies & Standards Template Solve?
Writing security documentation is a skill that many good cybersecurity professionals simply are not proficient at and avoid the task at all cost. Tasking your security analysts and engineers to write comprehensive documentation means you are actively taking them away from protecting and defending your network, which is not a wise use of their time. The SCRP is an efficient method to obtain comprehensive security policies, standards, controls and metrics for your organization!
Nearly every organization, regardless of industry, is required to have formally-documented security policies and standards. Requirements range from PCI DSS to HIPAA to NIST 800-171. The SCRP is designed with compliance in mind, since it focuses on leading security frameworks to address reasonably-expected security requirements.
Security documentation does not age gracefully like a fine wine. Outdated documentation leads to gaps that expose organizations to audit failures and system compromises. The SCRP's standards provides mapping to leading security frameworks to show you exactly what is required to both stay secure and compliant.
It is very common for clients and partners to request evidence of a security program and this includes policies and standards. The SCRP provides this evidence!
What Solutions Does It Provide?How Does The SCRP Solve These Problems?
The SCRP is built for organizations facing complex compliance requirements that benefit from the SCF's metaframework approach.
The SCRP provides comprehensive documentation to prove that your security program exists. This equates to a time saving of hundreds of hours and tens of thousands of dollars in staff and consultant expenses!
The SCRP can provide your organization with a semi-customized solution that requires minimal resources to fine tune for your organization's specific needs.
The SCRP is written to support over two hundred laws, regulations and industry frameworks!
The SCRP and its corresponding Cybersecurity Operating Procedures (CSOP), come together to provide "premium GRC content" that enables an organization to establish or refresh its GRC practices. They cover GRC policies, GRC standards, GRC metrics and more.
Common QuestionsFrequently-Asked Questions
Here are answers to common questions about the SCF policies and standards template:
What is included in an SCF policies and standards template?
ComplianceForge's SCF policies and standards template, the Security, Compliance & Resilience Program (SCRP), includes policies, control objectives, standards, guidelines, controls and metrics. Policies map 1-1 to SCF domains, while control objectives, standards and guidelines map 1-1 to individual SCF controls. Because we built it on the SCF, the SCRP also brings in mapped risks, threats and maturity criteria. Its metrics come from the Cybersecurity Metrics Reporting Model.
How many policy domains does the SCF policy template cover?
The SCF policy template covers 34 domains, which matches the 34 domains of the Secure Controls Framework. Each domain has its own policy, so every area of the SCF, from governance to secure engineering, is addressed by a written policy statement. Standards beneath each policy then cover the individual SCF controls in that domain, with one standard for each SCF control.
What file formats does the SCF policies and standards template come in?
The SCF policies and standards template comes in editable Microsoft Word and Excel formats. The Word documents work as a standalone policy set, while the Excel format makes it easier to import the content into a GRC platform. PowerPoint and PDF files are listed among the deliverables as well. The documentation is delivered same-day, so customization can start right after purchase.
Who should use an SCF-based policy template instead of a single-framework policy set?
An SCF-based policy template is best for organizations that must meet several laws, regulations and frameworks at once. Because the SCF maps to more than 200 of them, one SCF-based policy set can address overlapping requirements without separate documents for each framework. Organizations with a single requirement, such as ISO 27001 or NIST CSF 2.0 alone, may be better served by a framework-specific version of the Cybersecurity & Data Protection Program (CDPP).
Does an SCF policy template help with vendor security questionnaires?
Yes, an SCF policy template can help, because clients and partners often ask for evidence of a security program, and policies and standards are part of that evidence. An SCF-based policy set gives an organization written, framework-mapped documents it can share or reference when answering vendor questionnaires and due diligence requests. Because each standard maps to an SCF control, it is easier to show which framework requirements a given policy addresses.
