- The SCR establishes 34 common-sense principles organized by SCF control domains.
- These principles guide security & privacy by design, embedding protections from the start, not bolting them on after.
- Each principle maps to SCF controls that can operationalize it with specific, actionable requirements.
- ComplianceForge's SCRP product provides pre-built documentation aligned to these principles.
What Are Secure, Compliant & Resilient Principles?
The SCR principles are sourced from the Secure Controls Framework (SCF), which is a free resource. The SCF's comprehensive listing of over 1,400 cybersecurity and data privacy controls is categorized into 34 domains that are mapped to over 200 statutory, regulatory, and contractual frameworks. Those applicable SCF controls can operationalize the SCR principles to help an organization ensure that secure practices are implemented by design and by default.
Each of the 34 SCF domains has a corresponding SCR principle that defines the overarching goal for that domain. This creates a clear line from principle to control to implementation, ensuring nothing falls through the cracks.
The 34 Domain Principles
The SCR establishes 34 common-sense principles to guide the development and oversight of a modern security and privacy program. The SCR is sourced from the SCF, which is a free resource for businesses. The SCF’s free, comprehensive listing of over 1,400 cybersecurity and data privacy controls is categorized into 34 domains that are mapped to over 200 statutory, regulatory and contractual frameworks. Those applicable SCF controls can operationalize the SCR principles to help an organization ensure that secure practices are implemented by design and by default.
ComplianceForge's Security, Compliance & Resilience Program (SCRP) can help you operationalize these security & privacy principles:
Operationalizing SCR Principles
Principles without implementation are just words. The SCF provides the controls, and ComplianceForge provides the documentation to make them actionable.
The path from principle to practice follows a clear hierarchy. SCR Principles define the what at the highest level, SCF Controls define the specific safeguards needed, and ComplianceForge documentation provides the policies, standards, and procedures that operationalize those controls in your organization.
This approach ensures that security and privacy are not afterthoughts but are embedded into every aspect of your organization's technology, processes, and culture from the beginning.