+Statutory, Regulatory & Contractual Compliance

Statutory, Regulatory & Contractual Compliance

Description

Mechanisms exist to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ SCF Security, Compliance & Resilience Management System (SCRMS)
∙ Governance, Risk and Compliance (GRC) solution (e.g., SCFConnect, SureCloud, Ostendio, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ SCF Security, Compliance & Resilience Management System (SCRMS)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.)
∙ Steering committee

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Compliance (CPL) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with CPL domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Compliance management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Compliance efforts are narrowly-limited to certain compliance requirements.
▪ IT and/or cybersecurity personnel use an informal process to govern statutory, regulatory and contractual compliance obligations.

Level 2 Planned Tracked

Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.
▪ IT and/or cybersecurity perform an informal annual review of existing compliance requirements and research evolving or new requirements.

Level 3 Well Defined

Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the identification and implementation of relevant statutory, regulatory and contractual controls.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1. Apžvalga

Pavadinimas	Standartas

1.1 Nuorodos

1.2 Nustatyti reikalavimai

1.3 Susiję teisės aktai

2. Nustatyti reikalavimai

Reikalavimai
Šaltinis	Reikalavimas

3. Susiję teisės aktai

Teisės aktai
Šaltinis	Reguliavimas
EULAW	32 straipsnis Duomenų tvarkymo saugumas -
DELAW	BDSG § 9 Zuständigkeit (1) Die oder der Bundesbeauftragte ist zuständig für die Aufsicht über die öffentlichen Stellen des Bundes, auch soweit sie als öffentlich-rechtliche Unternehmen am Wettbewerb teilnehmen, sowie über Unternehmen, soweit diese für die geschäftsmäßige Erbringung von Telekommunikationsdienstleistungen Daten von natürlichen oder juristischen Personen verarbeiten und sich die Zuständigkeit nicht bereits aus § 29 des Telekommunikation-Digitale-Dienste-Datenschutz-Gesetzes ergibt. Die Vorschriften dieses Kapitels gelten auch für Auftragsverarbeiter, soweit sie nichtöffentliche Stellen sind, bei denen dem Bund die Mehrheit der Anteile gehört oder die Mehrheit der Stimmen zusteht und der Auftraggeber eine öffentliche Stelle des Bundes ist. (2) Die oder der Bundesbeauftragte ist nicht zuständig für die Aufsicht über die von den Bundesgerichten im Rahmen ihrer justiziellen Tätigkeit vorgenommenen Verarbeitungen.
EULAW	16 straipsnis Didelės rizikos DI sistemų tiekėjų pareigos 16 straipsnis Didelės rizikos DI sistemų tiekėjų pareigos Didelės rizikos DI sistemų tiekėjai: a) užtikrina, kad jų didelės rizikos DI sistemos atitiktų 2 skirsnyje nustatytus reikalavimus; b) ant didelės rizikos DI sistemos arba, jei to padaryti neįmanoma, ant jos pakuotės arba prie jos pridedamuose dokumentuose atitinkamai nurodo savo pavadinimą, registruotą prekybinį pavadinimą arba registruotą prekių ženklą ir adresą, kuriuo su jais galima susisiekti; c) įdiegia 17 straipsnio reikalavimus atitinkančią kokybės valdymo sistemą; d) saugo 18 straipsnyje nurodytus dokumentus; e) saugo savo didelės rizikos DI sistemų automatiškai generuojamus žurnalus, jei tik tie žurnalai yra jų žinioje, kaip nurodyta 19 straipsnyje; f) užtikrina, kad prieš pateikiant rinkai arba pradedant naudoti didelės rizikos DI sistemą būtų atliekama atitinkama jos atitikties vertinimo procedūra, kaip nurodyta 43 straipsnyje; g) parengia ES atitikties deklaraciją pagal 47 straipsnį; h) siekdami parodyti, kad jų didelės rizikos DI sistemos atitinka šio reglamento reikalavimus, pagal 48 straipsnį jas paženklina CE ženklu arba, jei to padaryti neįmanoma, paženklina jos pakuotę arba prie jos pridedamus dokumentus; i) vykdo 49 straipsnio 1 dalyje nurodytas registravimo pareigas; j) imasi būtinų taisomųjų veiksmų ir teikia informaciją, kaip reikalaujama 20 straipsnyje; k) nacionalinės kompetentingos institucijos pagrįstu prašymu įrodo, kad didelės rizikos DI sistema atitinka 2 skirsnyje nustatytus reikalavimus; l) užtikrina, kad didelės rizikos DI sistema atitiktų prieinamumo reikalavimus pagal direktyvas (ES) 2016/2102 ir (ES) 2019/882.
EULAW	17 straipsnis Kokybės valdymo sistema -
EULAW	21 straipsnis Bendradarbiavimas su kompetentingomis institucijomis -
EULAW	40 straipsnis Darnieji standartai ir standartizacijos leidiniai -
EULAW	4 straipsnis Proporcingumo principas -
EULAW	5 straipsnis Valdymas ir organizavimas -
EULAW	21 straipsnis Kibernetinio saugumo rizikos valdymo priemonės -
EULAW	6 straipsnis Produktams su skaitmeniniais elementais taikomi reikalavimai 6 straipsnis Produktams su skaitmeniniais elementais taikomi reikalavimai Produktai su skaitmeniniais elementais tiekiami rinkai tik jei: a) jie atitinka I priedo I dalyje nustatytus esminius kibernetinio saugumo reikalavimus, su sąlyga, kad jie yra tinkamai įrengiami, techniškai prižiūrimi, naudojami pagal numatytąją paskirtį arba tokiomis sąlygomis, kurias galima pagrįstai numatyti, ir, jei taikytina, juose yra įdiegti reikiami saugumo naujiniai, ir b) gamintojo įdiegti procesai atitinka I priedo II dalyje nustatytus esminius kibernetinio saugumo reikalavimus.
EULAW	12 straipsnis Didelės rizikos DI sistemos -
EULAW	19 straipsnis Importuotojų pareigos -
EULAW	23 straipsnis Ekonominės veiklos vykdytojų identifikavimas -
EULAW	24 straipsnis Atvirosios programinės įrangos valdytojų pareigos -
DELAW	BDSG § 76 Protokollierung (1) In automatisierten Verarbeitungssystemen haben Verantwortliche und Auftragsverarbeiter mindestens die folgenden Verarbeitungsvorgänge zu protokollieren: 1. Erhebung, 2. Veränderung, 3. Abfrage, 4. Offenlegung einschließlich Übermittlung, 5. Kombination und 6. Löschung. (2) Die Protokolle über Abfragen und Offenlegungen müssen es ermöglichen, die Begründung, das Datum und die Uhrzeit dieser Vorgänge und so weit wie möglich die Identität der Person, die die personenbezogenen Daten abgefragt oder offengelegt hat, und die Identität des Empfängers der Daten festzustellen. (3) Die Protokolle dürfen ausschließlich für die Überprüfung der Rechtmäßigkeit der Datenverarbeitung durch die Datenschutzbeauftragte oder den Datenschutzbeauftragten, die Bundesbeauftragte oder den Bundesbeauftragten und die betroffene Person sowie für die Eigenüberwachung, für die Gewährleistung der Integrität und Sicherheit der personenbezogenen Daten und für Strafverfahren verwendet werden. (4) Die Protokolldaten sind am Ende des auf deren Generierung folgenden Jahres zu löschen. (5) Der Verantwortliche und der Auftragsverarbeiter haben die Protokolle der oder dem Bundesbeauftragten auf Anforderung zur Verfügung zu stellen.
DELAW	BDSG § 77 Vertrauliche Meldung von Verstößen Der Verantwortliche hat zu ermöglichen, dass ihm vertrauliche Meldungen über in seinem Verantwortungsbereich erfolgende Verstöße gegen Datenschutzvorschriften zugeleitet werden können.
EULAW	4 straipsnis 1 1. Finansų sektoriaus subjektai įgyvendina II skyriuje nustatytas taisykles laikydamiesi proporcingumo principo, atsižvelgdami į savo įmonės dydį ir bendrą rizikos profilį, taip pat paslaugų, veiklos ir operacijų pobūdį, mastą ir sudėtingumą.
EULAW	4 straipsnis 2 2. Be to, III, IV skyrių ir V skyriaus I skirsnio taikymas finansų sektoriaus subjektams turi būti proporcingas jų įmonės dydžiui ir bendram rizikos profiliui, taip pat jų paslaugų, veiklos ir operacijų pobūdžiui, mastui ir sudėtingumui, kaip konkrečiai numatyta atitinkamose tuose skyriuose išdėstytose taisyklėse.
EULAW	4 straipsnis 3 3. Kompetentingos institucijos, peržiūrėdamos IRT rizikos valdymo sistemos nuoseklumą, apsvarsto, kaip finansų sektoriaus subjektai taiko proporcingumo principą, remdamosi ataskaitomis, pateiktomis kompetentingų institucijų prašymu pagal 6 straipsnio 5 dalį ir 16 straipsnio 2 dalį.
EULAW	5 straipsnis 4 4. Finansų sektoriaus subjekto valdymo organo nariai aktyviai siekia turėti naujausių pakankamų žinių ir įgūdžių IRT rizikai ir jos poveikiui finansų sektoriaus subjekto operacijoms suprasti ir įvertinti, be kita ko, reguliariai dalyvaudami specialiuose mokymuose, parengtuose atsižvelgiant į valdomą IRT riziką.
EULAW	97 straipsnis Autentiškumo patvirtinimas -

Susietos užduotys

Saitai
Saito tipas	Užduotis
is related to	Annual
is related to	relative Control Weighting = 10
is related to	Process
is related to	Detect
is related to	SCRM Focus Tier 1 STRATEGIC
is related to	SCRM Focus Tier 2 OPERATIONAL
is related to	SCRM Focus Tier 3 TACTICAL
blocks	Loss of Accountability / Attribution
blocks	Excessive or Unauthorized Privilege
blocks	Unauthorized Privilege Elevation
blocks	Unauthorized Access
blocks	Loss, Theft or Damage of Assets
blocks	Unauthorized Modification / Loss of System Integrity
blocks	Unauthorized Retention / Inability to Dispose of Data
blocks	Business / Service Interruption
blocks	Data Loss / Integrity Compromise
blocks	Reduced Operational Productivity
blocks	System / Data Compromise (Technical Vector)
blocks	System / Data Compromise (Non-Technical Vector)
blocks	Revenue Loss
blocks	Contractual Default / Termination
blocks	Loss of Competitive Advantage
blocks	Reputational Harm / Loss of Stakeholder Trust
blocks	Regulatory / Legal / Contractual Financial Liability
blocks	Exposure from Unaddressed Vulnerabilities
blocks	System / Service Compromise
blocks	Failure to Support Business / Mission Objectives
blocks	Unaddressed Security / Compliance Exposure
blocks	Unperformed / Unowned Control Responsibilities
blocks	Uncontrolled Internal Security / Privacy Exposure
blocks	Uncontrolled Third-Party Security / Privacy Exposure
blocks	Lack of oversight of internal controls
blocks	Lack of oversight of third-party controls
blocks	Harm from Illegal, Abusive or Unsafe Content / Conduct
blocks	Loss of Investigative / Evidentiary Capability
blocks	Delayed Containment / Increased Incident Impact
blocks	Incident Persistence / Recurrence
blocks	Incident Response / Recovery Cost
blocks	Undetected / Delayed Detection of Adverse Activity
blocks	Lack of a security-minded workforce
blocks	Third-Party Cybersecurity Compromise / Exposure
blocks	Third-Party Physical Security Disruption / Exposure
blocks	Sub-Tier / Fourth-Party Supply Chain Exposure
blocks	Third-Party Legal / Compliance Exposure
blocks	Harm from Unauthorized / Unintended Product or Service Use
blocks	Third-Party Dependency Failure
blocks	Data Obfuscation
blocks	Junk Data
blocks	Steganography
blocks	Protocol or Service Impersonation
blocks	OS Credential Dumping
blocks	LSASS Memory
blocks	Security Account Manager
blocks	NTDS
blocks	LSA Secrets
blocks	Cached Domain Credentials
blocks	DCSync
blocks	Proc Filesystem
blocks	/etc/passwd and /etc/shadow
blocks	Fallback Channels
blocks	SMB/Windows Admin Shares
blocks	VNC
blocks	Scheduled Transfer
blocks	Data Transfer Size Limits
blocks	Masquerading
blocks	Rename Legitimate Utilities
blocks	Match Legitimate Resource Name or Location
blocks	Double File Extension
blocks	Boot or Logon Initialization Scripts
blocks	Login Hook
blocks	Network Logon Script
blocks	RC Scripts
blocks	Startup Items
blocks	Exfiltration Over C2 Channel
blocks	Network Service Discovery
blocks	Exfiltration Over Alternative Protocol
blocks	Exfiltration Over Symmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Unencrypted Non-C2 Protocol
blocks	Exfiltration Over Physical Medium
blocks	Exfiltration over USB
blocks	Systemd Timers
blocks	Proc Memory
blocks	GUI Input Capture
blocks	Command and Scripting Interpreter
blocks	Visual Basic
blocks	JavaScript
blocks	AutoHotKey & AutoIT
blocks	Exploitation for Privilege Escalation
blocks	Indicator Removal
blocks	Clear Command History
blocks	Clear Network Connection History and Configurations
blocks	Clear Mailbox Data
blocks	Clear Persistence
blocks	Application Layer Protocol
blocks	Web Protocols
blocks	File Transfer Protocols
blocks	Mail Protocols
blocks	DNS
blocks	Software Deployment Tools
blocks	Valid Accounts
blocks	Default Accounts
blocks	Local Accounts
blocks	Cloud Accounts
blocks	Taint Shared Content
blocks	Proxy
blocks	Internal Proxy
blocks	External Proxy
blocks	Multi-hop Proxy
blocks	Non-Application Layer Protocol
blocks	Web Service
blocks	Dead Drop Resolver
blocks	Bidirectional Communication
blocks	One-Way Communication
blocks	Multi-Stage Channels
blocks	Ingress Tool Transfer
blocks	Brute Force
blocks	Password Guessing
blocks	Password Cracking
blocks	Password Spraying
blocks	Credential Stuffing
blocks	Multi-Factor Authentication Interception
blocks	Data Encoding
blocks	Standard Encoding
blocks	Non-Standard Encoding
blocks	Software Extensions
blocks	Browser Session Hijacking
blocks	Forced Authentication
blocks	Drive-by Compromise
blocks	Exploit Public-Facing Application
blocks	Supply Chain Compromise
blocks	Compromise Software Dependencies and Development Tools
blocks	Compromise Software Supply Chain
blocks	BITS Jobs
blocks	Password Policy Discovery
blocks	Exploitation for Client Execution
blocks	User Execution
blocks	Malicious Link
blocks	Malicious File
blocks	Malicious Image
blocks	Traffic Signaling
blocks	Port Knocking
blocks	Exploitation of Remote Services
blocks	Exploitation for Stealth
blocks	Exploitation for Credential Access
blocks	Data from Information Repositories
blocks	Confluence
blocks	Sharepoint
blocks	Code Repositories
blocks	Customer Relationship Management Software
blocks	Messaging Applications
blocks	System Binary Proxy Execution
blocks	Control Panel
blocks	Regsvr32
blocks	Rundll32
blocks	Verclsid
blocks	Electron Applications
blocks	Remote Access Tools
blocks	Template Injection
blocks	File and Directory Permissions Modification
blocks	Windows Permissions
blocks	Linux and Mac Permissions
blocks	Service Stop
blocks	Network Denial of Service
blocks	Direct Network Flood
blocks	Reflection Amplification
blocks	Endpoint Denial of Service
blocks	OS Exhaustion Flood
blocks	Service Exhaustion Flood
blocks	Application Exhaustion Flood
blocks	Application or System Exploitation
blocks	Steal Application Access Token
blocks	Data from Cloud Storage
blocks	Transfer Data to Cloud Account
blocks	Steal Web Session Cookie
blocks	ROMMONkit
blocks	TFTP Boot
blocks	Create or Modify System Process
blocks	Systemd Service
blocks	Windows Management Instrumentation Event Subscription
blocks	Unix Shell Configuration Modification
blocks	PowerShell Profile
blocks	Installer Packages
blocks	Time Providers
blocks	XDG Autostart Entries
blocks	Abuse Elevation Control Mechanism
blocks	Sudo and Sudo Caching
blocks	TCC Manipulation
blocks	Pass the Ticket
blocks	Unsecured Credentials
blocks	Credentials In Files
blocks	Credentials in Registry
blocks	Private Keys
blocks	Cloud Instance Metadata API
blocks	SIP and Trust Provider Hijacking
blocks	Credentials from Password Stores
blocks	Keychain
blocks	Securityd Memory
blocks	Modify Authentication Process
blocks	Domain Controller Authentication
blocks	Adversary-in-the-Middle
blocks	Name Resolution Poisoning and SMB Relay
blocks	ARP Cache Poisoning
blocks	DHCP Spoofing
blocks	Evil Twin
blocks	Steal or Forge Kerberos Tickets
blocks	Silver Ticket
blocks	Kerberoasting
blocks	AS-REP Roasting
blocks	Ccache Files
blocks	SSH Hijacking
blocks	NTFS File Attributes
blocks	Process Argument Spoofing
blocks	Data Manipulation
blocks	Stored Data Manipulation
blocks	Runtime Data Manipulation
blocks	Phishing
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Spearphishing via Service
blocks	Exfiltration Over Web Service
blocks	Dynamic Resolution
blocks	Domain Generation Algorithms
blocks	System Services
blocks	Service Execution
blocks	Lateral Tool Transfer
blocks	Non-Standard Port
blocks	Protocol Tunneling
blocks	Encrypted Channel
blocks	Symmetric Cryptography
blocks	Asymmetric Cryptography
blocks	Hijack Execution Flow
blocks	Dylib Hijacking
blocks	Path Interception by PATH Environment Variable
blocks	Path Interception by Search Order Hijacking
blocks	Path Interception by Unquoted Path
blocks	KernelCallbackTable
blocks	AppDomainManager
blocks	Phishing for Information
blocks	Spearphishing Service
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Network Boundary Bridging
blocks	Network Address Translation Traversal
blocks	Data from Configuration Repository
blocks	SNMP (MIB Dump)
blocks	Network Device Configuration Dump
blocks	Debugger Evasion
blocks	Plist File Modification
is related to	Semi-Annual
is related to	Govern
blocks	Failure to Achieve Strategic / Mission Objectives
blocks	Loss of Authorization / Certification / License
blocks	Inability to Demonstrate Due Diligence / Due Care
blocks	Unreliable Assurance / Decision Information
blocks	Sensitive Data / Compliance Exposure from Unsanctioned AI Use
blocks	AI Bias / Discriminatory Outcome
blocks	Privacy Harm / Unauthorized Processing
blocks	Drought & Water Shortage
blocks	Earthquakes
blocks	Fire & Wildfires
blocks	Floods
blocks	Hurricanes & Tropical Storms
blocks	Landslides & Debris Flow
blocks	Pandemic (Disease) Outbreaks
blocks	Severe Weather
blocks	Space Weather
blocks	Thunderstorms & Lightning
blocks	Tornadoes
blocks	Tsunamis
blocks	Volcanoes
blocks	Winter Storms & Extreme Cold
blocks	Dysfunctional Management Practices
blocks	Human Error
blocks	Statutory / Regulatory / Contractual Change
blocks	Fraud, Corruption and/or Intentional Criminal Conduct
blocks	Conflict of Interest (COI) / Undue Influence / Insider Misconduct
blocks	Economic Shock / Market Disruption
blocks	Foreign Ownership, Control, or Influence (FOCI)
blocks	Geopolitical Conflict / Government Intervention
blocks	Sanctions / Trade Restriction Disruption
blocks	Workforce Shortage / Loss of Critical Skills / Labor Disruption
blocks	SP-01.01B
blocks	SP-02.01B
blocks	HR-02.01B
blocks	OPS-10.01B
blocks	OPS-32.03B
blocks	CRY-01.01B
blocks	PI-02.01AC
blocks	SSO-01.01B
blocks	COM-01.01B
blocks	COM-01.01AC
blocks	INQ-04.02B
is blocked by	CPL-02 Statutory, Regulatory & Contractual Compliance – Assessment Procedure
blocks	PL-01 Policy and Procedures
blocks	PM-08 Critical Infrastructure Plan
blocks	PL-01 [L] Policy and Procedures
blocks	PL-01 [M] Policy and Procedures
blocks	PL-01 [H] Policy and Procedures
blocks	PL-01 [P] Policy and Procedures
blocks	PM-08 [P] Critical Infrastructure Plan
blocks	03.04.11 Information Location
blocks	03.12.01 Security Assessment
blocks	GV.OC Organizational Context
blocks	GV.OC-03 Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and …
blocks	GV.SC-05 Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of …
blocks	PR PROTECT
blocks	PO.1 Define Security Requirements for Software Development
blocks	PO.1.2 Identify and document all security requirements for organization-developed software to meet, and maintain the requirements over time.

Secure Controls Framework -
The Secure Controls Framework® (SCF)

"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.

The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.

Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.

The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/

Terms & Conditions

The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.