CMMC Practitioners

Secure Controls Framework (SCF)

support@securecontrolsframework.com

https://securecontrolsframework.com

 

Specialty: For organizations that face more complex compliance requirements than meeting just NIST 800-171 / CMMC, the Secure Controls Framework (SCF) might be just what you are looking for. The SCF uses Creative Commons licensing, so it is free. It has complete coverage for NIST SP 800-171 R2, NIST SP 800-171 R3 FPD, NIST SP 800-172 and CMMC Levels 1-3. 

​

The SCF is a more efficient way to operationalize cybersecurity and data privacy operations by simplifying the underlying controls that power an organization’s cybersecurity program. The reality is that most organizations struggle with defining the minimum security requirements that are necessary to address both their compliance obligations and needs for secure practices. The SCF provides a straightforward and scalable method to define those “must have” and “nice to have” requirements into a holistic control set to operationalize cybersecurity operations, risk management and third-party governance. There is no cost to use the SCF and quite a few Governance Risk and Compliance (GRC) platforms natively support the SCF as a built-in control set. 

​

In simple terms, the SCF is a metaframework where it is a catalog of controls made up of over 100 cybersecurity and data privacy laws, regulations and frameworks. This control catalog contains roughly 1,200 controls and is logically organized into 33 domains. The structure of the SCF normalizes disparate control language into something that is usable across technology, cybersecurity, privacy and other departments where they can share the same control language. 

​

The SCF is much more than just a control set! 

• Each control has a control weighting to help understand risk, since not all controls are the same.

• There is a built-in risk catalog and threat catalog, where those risks and threats are mapped to SCF controls.

• There is a capability maturity model to help define what right looks like for your organization.

• There is a risk management model to enable holistic risk management practices at the control level.

• There is an evidence request list to define expected assessment artifacts that would be reasonably expected to satisfy controls.

• We even have assessment objectives to help provide objective criteria that can be used to assess controls.