Security, Compliance & Resilience Management System (SCRMS)

The SCRMS is a free resource to help organizations design and implement their Governance, Risk & Compliance (GRC) practices centered around applicable cybersecurity and data protection controls. By design, the SCRMS expands upon and modernizes the concept of traditional Information Security Management System (ISMS) models, due to the archaic nature of multiple, siloed “management systems” that are necessary to provide reasonable governance practices (e.g., Artificial Intelligence Management System (AIMS) add-on).

The SCRMS is not a “one-size-fits-all” playbook. It is designed to be adopted and tailored to the unique size, resources, and risk circumstances of each organization. The SCRMS expands upon and modernizes traditional Information Security Management System (ISMS) models, replacing siloed “management systems” with a single, unified operational framework that governs cybersecurity, data privacy, risk, and compliance together.

Key Takeaways - SCRMS: How To Implement The SCF

The SCRMS is a free resource for designing and implementing GRC practices centered on cybersecurity and data protection controls.
Controls are the central nexus. Policies, standards, procedures, metrics, threats, and risks all map to controls.
MCR (Minimum Compliance Requirements) vs DSR (Discretionary Security Requirements) helps categorize must have vs nice to have.
The SCRMS defines 9 principles following the Plan, Do, Check & Act (PDCA) cycle.
Being secure, compliant, and resilient are three distinct but interdependent outcomes.

Controls-Centric GRC

What Is The SCRMS?

The Security, Compliance & Resilience Management System (SCRMS) is a free resource to help organizations design and implement their Governance, Risk & Compliance (GRC) practices to center around applicable cybersecurity and data protection controls. The premise of the SCRMS is that controls are central to cybersecurity and data privacy operations, as well as the overall business rhythm of an organization. This is supported by the Secure, Compliant & Resilient Risk Management Model (SCR-RMM), that describes the central nature of controls, where not just policies and standards map to controls, but procedures, metrics, threats and risks, as well. The SCRMS model takes a different approach from the traditional definition of GRC, since SCRMS is controls-centric, where controls are viewed as the nexus, or central pivoting point, for an organization’s cybersecurity and privacy operations.

OCEG defines GRC as, “GRC is the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity,” while Gartner jointly defines GRC/IRM as, "a set of practices and processes supported by a risk-aware culture and enabling technologies, that improves decision making and performance through an integrated view of how well an organization manages its unique set of risks."

ComplianceForge and Secure Controls Framework (SCF), the developers of the SCRMS model, define SCRMS as, “a holistic, technology-agnostic approach to cybersecurity and data protection controls to identify, implement and manage secure and compliant practices, covering an organization’s people, processes, technology and data, regardless of how or where data is stored, processed and/or transmitted.”

Must Have vs Nice To Have

Compliant vs Secure

Unlike traditional GRC, the SCRMS specifically focuses on clarifying the difference between compliant versus secure, a distinction necessary for coherent risk management.

Minimum Compliance Requirements (MCR)

MCR represent the minimum bar required by external obligations such as laws, regulations, and contracts. These are non-negotiable. Not implementing them creates legal or contractual exposure.

Externally influenced (laws, regs, contracts)
"Must have" requirements (e.g., non-discretionary)
Fact-finding, not risk assessment
Forms compliance baseline

Discretionary Security Requirements (DSR)

DSR are selected based on the organization's own risk appetite and judgment. These go beyond the minimum and represent best-practice enhancements driven by internal risk management.

Internally influenced (risk-based decisions)
"Nice to have" (e.g., risk-informed choices, discretionary)
Based on threat landscape and asset sensitivity
Elevates posture beyond compliance floor

Key Insight

Secure and compliant operations exist when both MCR and DSR are implemented and properly governed. MCR establishes the foundational floor, while DSR is where real security improvements happen.

How To GRC Playbook

Addresses Tactical, Operational & Strategic Nature

SCRMS is designed to proactively address the strategic, operational and tactical nature of operating an organization’s cybersecurity and privacy program at the control level. SCRMS is designed to address both internal controls, as well as the broader concept of Supply Chain Risk Management (SCRM).

Three Distinct Outcomes

Secure, Compliant & Resilient

These three terms represent distinct but interdependent outcomes that organizations should strive for.

Secure

An entity can reasonably claim it is secure if it has implemented and operational defenses focused on Confidentiality, Integrity, Availability, and Safety (CIAS). Security level is dynamic, based on implemented defensive capabilities and applicable risks and threats.

Compliant

An entity can reasonably claim it is compliant if it can demonstrate conformity with applicable laws, regulations, and other obligations. The scope of compliance includes both external and internal requirements.

Resilient

An entity can reasonably claim it is resilient if it has prepared for and has the ability to adapt to changing conditions, where it can withstand or recover rapidly from disruption, including deliberate attacks, accidents, or naturally occurring threats.

The How-To Playbook

9 SCRMS Principles

The SCRMS provides nine principles that follow the Plan, Do, Check & Act (PDCA) cycle.

Principle

Description

Establish Context

To build and maintain efficient and effective operations, a cybersecurity and data protection program must have a hierarchical vision, mission and strategy that directly supports the entity’s broader strategic objectives and business processes. This process of establishing context involves identifying all applicable external compliance requirements (e.g., laws, regulations and contractual obligations), internal directives (e.g., Board of Directors, corporate policies, etc.). This also includes understanding applicable risks and threats, since the entity’s exposure to those may influence the need for controls beyond those that are mandated as compliance obligations.

Identify Applicable Controls

A tailored set of cybersecurity and data protection controls must exist for an entity to implement a SCRMS. This control set needs to be tailored for the entity’s unique requirements, such as a combination of Minimum Compliance Requirements (MCR) and Discretionary Security Requirements (DSR). This blend of “must have” and “nice to have” requirements establish an entity’s tailored control set to help ensure secure, compliant and resilient capabilities.

Define Maturity Expectations

The entity must define maturity expectations for its cybersecurity and data protection controls. From the perspective of the SCRMS, the maturity expectations define entity-specific “what right looks like” expectations for control implementation and continued operation. The maturity-based criteria are applicable to People, Processes, Technologies, Data & Facilities (PPTDF).

Publish Governance Documentation

Cybersecurity and data protection documentation must exist, otherwise an entity’s governance practices are both unenforceable and indefensible. Formalizing entity-specific requirements via documented policies, standards and procedures are necessary to operationalize cybersecurity and data protection controls. Documented policies, standards and procedures provide evidence of due diligence that the entity identified and implemented reasonable steps to address its applicable requirements. The output of procedures provides evidence of due care that controls were operated as described.

Assign Stakeholder Accountability

Controls must be assigned to stakeholders to ensure accountability (e.g., business units, teams and/or individuals). These “control owners” are expected to assign the task of executing controls to “control operators” at the Individual Contributors (IC)-level.

Prioritize Capabilities According To Risk

Security, compliance and resilience capabilities must be prioritized based on applicable risks and threats. Not all risks and threats are equal, so a risk-based prioritization must occur.

Maintain Situational Awareness

Situational awareness must involve more than merely “monitoring controls” (e.g., metrics). While metrics are a point-in-time snapshot into discrete controls performance, the broader view of metrics leads to a longer-term trend analysis (e.g., analytics). When properly tied in with current audits, control deficiencies, risk, threat and vulnerability information, this broader insight provides “situational awareness” that is necessary for an entity’s leadership to adjust plans to operate within the defined risk threshold.

Manage Risk

Proactive risk management processes must exist across all phases of Technology Assets, Applications, Services and/or Data (TAASD) life cycles to address Confidentiality, Integrity, Availability and Safety (CIAS) aspects. Based on finite resources (e.g., time, personnel and money), it is necessary to utilize prioritized risk management practices that ensure issues posing the highest risk are addressed first. Risk management must address internal and external factors, including data privacy, Artificial Intelligence (AI), embedded technology and Supply Chain Risk Management (SCRM) considerations. To manage risk, it requires the entity to enforce a clearly-defined risk threshold and ensure reasonable security practices are operational.

Evolve Processes

Cybersecurity and data protection measures must adapt and evolve to address business operations and the evolving threat landscape. This requires the adoption of a Plan, Do, Check & Act (PDCA) approach (e.g., Deming Cycle) to ensure the entity proactively identifies its requirements, implements appropriate protections, maintains situational awareness to detect incidents, operates a viable capability to respond to incidents and can sustain key business operations, if an incident occurs.

Plan, Do, Check, Act (PDCA)

PDCA Approach To GRC

The PDCA approach enables continuous evaluation of risks, threats, and performance trends so leadership can minimize risk by modifying how people, processes, and technology work together. The Secure Controls Framework (SCF) can be an excellent starting point for a control set if your organization lacks a comprehensive set of cybersecurity and privacy controls.

Plan

The overall GRC process beings with planning. This planning will define the policies, standards and controls for the organization. It will also directly influence the tools and services that an organization purchases, since technology purchases should address needs that are defined by policies and standards.

Do

Arguably, this is the most important section for cybersecurity and privacy practitioners. Controls are the “security glue” that make processes, applications, systems and services secure. Procedures (also referred to as control activities) are the processes how the controls are actually implemented and performed.

Check

In simple terms, this is situational awareness. Situational awareness is only achieved through reporting through metrics and reviewing the results of audits/assessments.

Act

This is essentially risk management, which is an encompassing area that deals with addressing two main concepts (1) real deficiencies that currently exist and (2) possible threats to the organization.

Free Resource

The SCRMS is freely available from the Secure Controls Framework website. ComplianceForge provides pre-built documentation (SCRP) that operationalizes the SCRMS principles with editable policies, standards, and procedures.

What is GRC?

What is Governance, Risk & Compliance (GRC)?

Cybersecurity Governance, Risk, & Compliance (GRC) is an integrated approach organizations use to align cybersecurity and data privacy requirements with business objectives.

Which comes first? Governance, Risk or Compliance? This has been a hotly-debated topic since GRC was first coined over two (2) decades ago. However, there is a logical order to GRC processes that must be understood to avoid siloes and an improperly scoped security program. First, it is necessary to level-set on the terminology of what GRC functions do:

Structures the organization’s controls to align with business goals and applicable statutory, regulatory, contractual and other obligations. Develops necessary policies and standards to ensure the proper implementation of controls.
Risk Management. Identifies, quantifies and manages risk to information and technology assets, based on the organization’s operating model.
Oversight of control implementation to ensure the organization’s applicable statutory, regulatory, contractual and other obligations are adequately met. Conducts control validation testing and audits/assessments.

Compliance > Governance > Risk Management

When establishing GRC practices, what is described below is the precedence of how (1) Compliance influences (2) Governance, which influences (3) Risk management.

The genesis of GRC is to first identify applicable statutory, regulatory and contractual obligations that the organization must adhere to, as well as internal business requirements (e.g., Board of Director directives). This is a compliance function that identifies statutory, regulatory and contractual obligations. It is a due diligence exercise to identify what the organization is reasonably required to comply with from a cybersecurity & data privacy perspective. This process involves interfacing with various Lines of Business (LOB) to understand how the organization operates, including geographic considerations. Generally, Compliance needs to work with the legal department, contracts management, physical security and other teams to gain a comprehensive understanding of the organizational compliance needs.

Governance Has Two (2) Key Functions:

Develop policies and standards to meet those compliance obligations (defined by applicable control objectives); and
Assign ownership of those controls to the applicable stakeholders involved in the affected business processes. This process often requires a documented Responsibility, Accountability, Supportive, Consulted and Informed (RASCI) chart to ensure the organizational model supports effective implementation and oversight of the assigned controls.

From a trickle-down perspective, while Risk Management logically follows both Compliance and Governance functions in establishing a GRC program, Risk Management is crucial for the organization to maintain situational awareness and remain both secure and compliant. Risk Management serves as the primary "canary in the coal mine" to identify instances of noncompliance that lead to the improper management of risks and exposure of the organization to threats; since ongoing risk assessments generally occur more frequently than internal/external audits that Compliance may oversee.