What is SCF?

The SCF is a common-controls metaframework, a comprehensive cybersecurity and data privacy control framework designed to help organizations implement and manage information security, risk management and compliance requirements.

The SCF is a metaframework where it is a catalog of controls made up of over 200 cybersecurity and data privacy laws, regulations and frameworks. This control catalog contains 1,400+ controls and is logically organized into 33 domains. The structure of the SCF normalizes disparate control language into something that is usable across technology, cybersecurity, privacy and other departments where they can share the same control language. The SCF enables not only intra-organization standardization, but inter-organization standardization where control GOV-03 means the same thing to one organization to any other organization using the SCF.

The SCF is a more efficient way to operationalize cybersecurity and data privacy operations by simplifying the underlying controls that power an organization’s cybersecurity program. The SCF provides a straightforward and scalable method to define those “must have” and “nice to have” requirements into a holistic control set to operationalize cybersecurity operations, risk management and third-party governance. There is no cost to use the SCF and quite a few Governance, Risk and Compliance (GRC) platforms natively support the SCF as a built-in control set.

The “sweet spot” for the SCF is medium to large organizations, but it has been successfully used by small organizations. Any organization with complex compliance requirements can benefit from using the SCF. We are just trying to make it easier for cybersecurity practitioners to do their jobs, since we all benefit from organizations having better security practices in place.

SCF is used by organizations to:

• Align cybersecurity and data protection controls with an expansive catalog of laws, regulations and frameworks;
• Provide a streamlined set of actionable security controls to address its specific compliance, security and resiliency needs; and
• Support risk management and continuous monitoring programs.

The SCF is much more than just a cybersecurity control set, since the SCF has:

• Control weighting to help understand risk, since not all controls are the same;
• A built-in risk catalog and threat catalog, where those risks and threats are mapped to SCF controls;
• A capability maturity model to help define what right looks like for your organization;
• A risk management model to enable holistic risk management practices at the control level;
• An Evidence Request List (ERL) to define expected assessment artifacts that would be reasonably expected to satisfy controls; and
• Assessment Objectives (AOs) to help provide objective criteria that can be used to assess controls.