Secure Controls Framework

1. Panoramica

Titolo	Standard
Security, Compliance & Resilience Governance	Security, Compliance & Resilience (SCR) Principles Govern the organization’s Security, Compliance & Resilience Program (SCRP) through accountable oversight, evidence-based decision-making and defensible evidence that the organization is secure, compliant and resilient. Principle Intent Organizations establish and maintain governance structures, decision rights, accountability mechanisms and documented evidence to demonstrate that security, compliance and resilience practices are designed, implemented, monitored and improved in a manner that can withstand scrutiny from leadership, regulators, auditors, customers and other interested parties.
Artificial Intelligence & Autonomous Technologies	Security, Compliance & Resilience (SCR) Principles Govern Artificial Intelligence & Autonomous Technologies (AAT) through trustworthy, secure and resilient lifecycle practices that manage intended and unintended outcomes. Principle Intent Organizations ensure AAT capabilities are designed, developed, deployed, monitored and governed to be reliable, safe, fair, secure, resilient, transparent, explainable and privacy-enhancing, with risk management practices that address model, agent and autonomous decision-making risks.
Asset Management	Security, Compliance & Resilience (SCR) Principles Manage Technology Assets, Applications and Services (TAAS) throughout their lifecycle to maintain visibility, accountability, authorization and protection. Principle Intent Organizations maintain accurate inventories, ownership records and data relationships for TAAS from procurement through disposal to ensure only authorized assets, applications and services are used and associated data is protected throughout its lifecycle.
Business Continuity & Disaster Recovery	Security, Compliance & Resilience (SCR) Principles Maintain resilient capabilities to sustain business-critical functions and recover from disruptions through documented, tested and maintained continuity and recovery processes. Principle Intent Organizations establish, exercise and improve Business Continuity and Disaster Recovery (BC/DR) capabilities to minimize operational disruption from adverse events, meet recovery objectives and support business, legal, regulatory and stakeholder obligations.
Capacity & Performance Planning	Security, Compliance & Resilience (SCR) Principles Govern current and future capacity and performance requirements for Technology Assets, Applications, Services and Data (TAASD) to sustain reliable operations. Principle Intent Organizations prevent avoidable business interruptions caused by capacity and performance limitations through baselines, thresholds, forecasting, demand planning and leadership visibility into current and future performance needs.
Change Management	Security, Compliance & Resilience (SCR) Principles Manage changes to Technology Assets, Applications, Services and Data (TAASD) through an authorized, risk-based process that evaluates, implements and validates changes before and after deployment. Principle Intent Organizations ensure technology and business stakeholders assess, authorize, test, implement, monitor and validate changes to minimize production impact, preserve availability, support rollback and maintain secure configurations.
Cloud Security	Security, Compliance & Resilience (SCR) Principles Govern cloud services and environments through risk-based, cloud-native security, compliance and resilience practices aligned with shared responsibility obligations. Principle Intent Organizations govern private, public and hybrid cloud environments, including IaaS, PaaS and SaaS, to manage shared responsibility risks, third-party dependencies, architectural decisions, data protection, portability and resilience requirements.
Compliance	Security, Compliance & Resilience (SCR) Principles Govern security, compliance and data protection obligations to maintain defensible evidence of conformity with applicable internal and external requirements. Principle Intent Organizations identify, interpret, implement and maintain evidence of conformity with applicable statutory, regulatory, contractual and internal obligations to demonstrate due diligence and due care.
Configuration Management	Security, Compliance & Resilience (SCR) Principles Establish and enforce secure configuration baselines that implement least privilege and least functionality for Technology Assets, Applications and Services (TAAS) to support a defensible secure configuration posture. Principle Intent Organizations establish, maintain, monitor and enforce secure configurations aligned with vendor recommendations and industry-recognized secure practices to preserve system integrity and prevent unauthorized or unintended functionality.
Continuous Monitoring	Security, Compliance & Resilience (SCR) Principles Maintain situational awareness through centralized collection, correlation and analysis of security-relevant telemetry from Technology Assets, Applications and Services (TAAS). Principle Intent Organizations establish enterprise-wide situational awareness through centralized collection, correlation, analysis and review of security-relevant events, telemetry and control status to reduce blind spots that could contribute to compromise, data exfiltration or TAAS unavailability.
Cryptographic Protections	Security, Compliance & Resilience (SCR) Principles Use appropriate cryptographic mechanisms and industry-recognized key management practices to protect sensitive and regulated data at rest and in transit. Principle Intent Organizations protect the confidentiality and integrity of data through approved cryptographic technologies, key lifecycle management, cryptographic inventory practices and migration planning that supports secure, resilient and compliant cryptographic protections.
Data Classification & Handling	Security, Compliance & Resilience (SCR) Principles Enforce a standardized classification methodology to determine data sensitivity and support Technology Assets, Applications and Services (TAAS) criticality decisions, enabling appropriate data handling, protection, retention and disposal requirements. Principle Intent Organizations classify Technology Assets, Applications, Services and Data (TAASD) and implement risk-appropriate handling, protection, retention and disposal safeguards to prevent unauthorized disclosure, modification or misuse of data throughout its lifecycle.
Embedded Technology	Security, Compliance & Resilience (SCR) Principles Apply risk-based security, compliance and resilience practices to embedded technologies where compromise or misuse could create operational, safety and/or data protection impacts. Principle Intent Organizations develop, deploy, harden, monitor and maintain embedded technologies, including IoT and Operational Technology (OT), with safeguards for hardware, firmware, software, communications, service protocols and safety-related dependencies.
Endpoint Security	Security, Compliance & Resilience (SCR) Principles Harden and centrally manage endpoint devices to protect Technology Assets, Applications, Services and Data (TAASD) from unauthorized access, compromise and disruption. Principle Intent Organizations protect endpoint devices and associated data through secure configuration, access control, malware protection, monitoring, response and lifecycle management practices aligned with applicable security, compliance and resilience obligations.
Human Resources Security	Security, Compliance & Resilience (SCR) Principles Execute security-informed personnel management practices that address screening, onboarding, acceptable behavior, role-based risk, competence and offboarding requirements. Principle Intent Organizations cultivate a security, compliance and resilience-minded workforce by defining personnel security expectations, validating role-based competence, supporting appropriate culture and collaboration, and managing personnel risk throughout the employment lifecycle.
Identification & Authentication	Security, Compliance & Resilience (SCR) Principles Implement secure, compliant and resilient Identity and Access Management (IAM) capabilities that enforce least privilege across human users, devices, service accounts and other Non-Person Entities (NPEs). Principle Intent Organizations enforce least privilege by limiting access to Technology Assets, Applications, Services and Data (TAASD) to authorized users, services and entities with Need to Know (NTK) / Need to Access (NTA) based on approved identities, authentication strength, attributes and access rights.
Incident Response	Security, Compliance & Resilience (SCR) Principles Maintain a tested incident response capability that enables trained responders to identify, analyze, contain, eradicate and recover from incidents according to documented Incident Response Plans (IRPs). Principle Intent Organizations establish, maintain and exercise the capability to lawfully and effectively respond to cybersecurity incidents in a timely manner, preserve evidence and notify affected stakeholders as required.
Information Assurance	Security, Compliance & Resilience (SCR) Principles Execute Information Assurance (IA) practices to validate that expected security, compliance and resilience controls are appropriately designed and operating as intended for Technology Assets, Applications and Services (TAAS). Principle Intent Organizations validate the adequacy and operating effectiveness of security, compliance and resilience controls across development, testing and production environments through assurance activities that support defensible risk and compliance decisions.
Maintenance	Security, Compliance & Resilience (SCR) Principles Proactively maintain Technology Assets, Applications and Services (TAAS) through authorized maintenance practices that preserve performance, security, compliance, resilience and supportability. Principle Intent Organizations perform, monitor and document maintenance for TAAS, including third-party-supported or hosted technologies, to preserve operational effectiveness and apply additional scrutiny to end-of-life or unsupported components.
Mobile Device Management	Security, Compliance & Resilience (SCR) Principles Govern mobile device access to Technology Assets, Applications, Services and Data (TAASD) to reduce attack surface and data exposure. Principle Intent Organizations manage risks associated with organization-owned, employee-owned and third-party-owned mobile devices through centralized, risk-based controls for device access, configuration, data storage, monitoring and remote management commensurate with ownership model and risk.
Network Security	Security, Compliance & Resilience (SCR) Principles Architect and implement defense-in-depth network protections that segment, restrict and monitor access to Technology Assets, Applications, Services and Data (TAASD). Principle Intent Organizations architect and operate security, compliance and resilience controls that protect the Confidentiality, Integrity, Availability and Safety (CIAS) of network infrastructure through segmentation, traffic control, secure connectivity and situational awareness of network activity.
Physical & Environmental Security	Security, Compliance & Resilience (SCR) Principles Protect physical environments through layered physical security and environmental controls that safeguard physical and digital assets from unauthorized access, theft, damage and disruption. Principle Intent Organizations limit physical access to Technology Assets, Applications, Services and Data (TAASD) and monitor environmental conditions commensurate with risk to prevent unauthorized access and reduce equipment failure, damage or disruption from physical and environmental threats.
Data Privacy	Security, Compliance & Resilience (SCR) Principles Execute risk-based and legally defensible data privacy practices that conform with applicable statutory, regulatory and contractual obligations to protect sensitive Personal Data (sPD) throughout its lifecycle. Principle Intent Organizations govern and implement privacy practices that align with overall privacy strategy; meet statutory regulatory and contractual obligations; ensure privacy by design and by default; protect individual rights; and provide lawful processing and safeguards for sensitive Personal Data (sPD).
Project & Resource Management	Security, Compliance & Resilience (SCR) Principles Operationalize security, compliance and resilience objectives by integrating cybersecurity and data privacy requirements into project, program and resource management practices. Principle Intent Organizations ensure security-related initiatives have defined ownership, funding, staffing, dependencies, schedules and project/program management support necessary for successful execution.
Risk Management	Security, Compliance & Resilience (SCR) Principles Proactively identify, assess, prioritize and treat risks to align Technology Assets, Applications, Services and Data (TAASD)-related decisions with the organization's defined risk appetite and risk tolerance. Principle Intent Organizations ensure business units and process owners understand their roles and responsibilities applicable to effective management of security, compliance, privacy and resilience risks, while cybersecurity and data privacy teams advise on risk matters and business stakeholders retain risk ownership.
Secure Engineering & Architecture	Security, Compliance & Resilience (SCR) Principles Apply industry-recognized secure engineering and architecture principles to deliver secure, compliant and resilient systems, applications and services. Principle Intent Organizations align cybersecurity engineering and architecture decisions with the organization’s technology strategy and industry-recognized practices, including secure-by-design, threat modeling, resilience engineering and defensible architecture decisions.
Security Operations	Security, Compliance & Resilience (SCR) Principles Deliver secure, compliant and resilient operations through defined processes, skilled personnel, monitoring, escalation and continuous improvement that effectively detect, isolate, and remediate cyber threats while ensuring business resilience. Principle Intent Organizations establish resources, procedures, runbooks and management structures to deliver effective cybersecurity, physical security and data privacy operations aligned with organizational risk, service and resilience needs.
Security Awareness & Training	Security, Compliance & Resilience (SCR) Principles Foster a security, compliance and resilience-minded workforce through ongoing, role-based education on evolving threats, obligations and secure workplace practices. Principle Intent Organizations develop and sustain a security, compliance and resilience-minded workforce through continuous education, awareness activities, practical exercises and role-based training that reinforces expected behaviors.
Technology Development & Acquisition	Security, Compliance & Resilience (SCR) Principles Develop and acquire Technology Assets, Applications and Services (TAAS) through secure-by-design, risk-informed and resilient lifecycle practices. Principle Intent Organizations integrate security, compliance and resilience requirements into internally developed and acquired TAAS, including secure development practices, acquisition due diligence, supplier requirements, validation, acceptance criteria and least privilege/least functionality expectations.
Third-Party Management	Security, Compliance & Resilience (SCR) Principles Execute Supply Chain Risk Management (SCRM) practices to assess, select, contract, monitor and manage trustworthy third parties for product and service delivery. Principle Intent Organizations minimize security, compliance and resilience risks associated with third parties through due diligence, contractual safeguards, ongoing monitoring, performance management, contingency planning and exit strategies.
Threat Management	Security, Compliance & Resilience (SCR) Principles Proactively identify, assess and manage threats to Technology Assets, Applications, Services and Data (TAASD) and business processes to inform risk decisions and corrective actions. Principle Intent Organizations establish threat intelligence-informed capabilities to identify, assess, prioritize and manage technology-related and business-process threats to TAASD and determine appropriate risk responses.
Vulnerability & Patch Management	Security, Compliance & Resilience (SCR) Principles Reduce exploitable weaknesses in Technology Assets, Applications and Services (TAAS) through coordinated vulnerability identification, prioritization, remediation and validation practices. Principle Intent Organizations manage technical vulnerabilities through asset-aware discovery, vulnerability assessment, risk-based prioritization, patch management, threat intelligence, remediation validation and change management practices.
Web Security	Security, Compliance & Resilience (SCR) Principles Protect Internet-facing Technology Assets, Applications and Services (TAAS) by minimizing attack surfaces and monitoring for anomalous activity. Principle Intent Organizations reduce risks associated with Internet-accessible TAAS through secure configuration, web and Application Programming Interface (API) security controls, content and file integrity monitoring, logging, auditing and detection of malicious activity.
Quantum Security	Security, Compliance & Resilience (SCR) Principles Mitigate quantum-enabled cryptographic risks through governance structures that operationalize Post-Quantum Cryptography (PQC) risk management practices. Principle Intent Organizations identify, assess and mitigate risks associated with Cryptographically Relevant Quantum Computers (CRQCs), including risks that may render legacy cryptographic mechanisms ineffective, through cryptographic inventory, prioritization, migration planning and cryptographic agility.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti
Fonte	Requisito

3. Regolamentazioni correlate

Regolamentazioni
Fonte	Regolamentazione

Ticket collegati

Collegamenti
Tipo di collegamento	Ticket
includes	Access Control
includes	Asset Management
includes	Business Continuity
includes	Exposure
includes	Governance
includes	Incident Response
includes	Situational Awareness
includes	Supply Chain
includes	Operational Resilience
includes	Artificial Intelligence & Autonomous Technologies
includes	Operational Technology (OT)
includes	Information Protection
includes	Safety
includes	Personnel
is related to	English
is related to	New version: Secure Controls Framework (SCF) (2026.3-86f09c716a) – 47 new, 1591 changed, 757 removed, 57494 links
includes	Natural Threat
includes	Man-Made Threat
is related to	Assignments added: Secure Controls Framework (SCF) (2026.3-86f09c716a) – 112 links
is related to	New version: Secure Controls Framework (SCF) (2026.3-86f09c716a) – 1592 new, 0 changed, 0 removed, 1591 links
includes	SCF Assessment Objectives
is related to	Assignments added: Secure Controls Framework (SCF) (2026.3-86f09c716a) – 5131 links

Secure Controls Framework -
The Secure Controls Framework® (SCF)

"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.

The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.

Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.

The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/

Terms & Conditions

The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.

Secure Controls Framework

1. Panoramica

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

Security, Compliance & Resilience (SCR) Principles

Principle Intent

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

The Secure Controls Framework® (SCF)

Terms & Conditions