Free Cybersecurity & GRC Content

Full Control Catalog — 1,400+ Controls

The SCF control catalog spans all 33 cybersecurity and data privacy domains — from Governance and Asset Management through Cloud Security and Privacy. Each control includes a unique SCF identifier, control objective, capability maturity criteria at each SCR-CMM level (1–5), proposed weighting, and threat/risk catalog crosswalks.

200+ Framework Mappings via STRM

Every SCF control is mapped to all applicable laws, regulations, and frameworks using the NIST IR 8477 Set Theory Relationship Mapping (STRM) methodology. Mappings include NIST SP 800-53, NIST CSF 2.0, ISO 27001/2, CIS Controls v8, HIPAA, PCI DSS v4, SOC 2, CMMC 2.0, GDPR, CCPA/CPRA, DORA, NIS2, FedRAMP, and 185+ more.

NIST OSCAL JSON Export

The SCF’s NIST OSCAL JSON export enables machine-readable exchange of control catalogs and profiles. It supports native import into FedRAMP automation pipelines, automated compliance workflows, interoperability with OSCAL-compatible GRC tools, and machine-readable crosswalk data for automated gap analysis.

Cybersecurity & Data Privacy Assessment Standards (CDPAS)

The CDPAS provides standardized assessment criteria for evaluating cybersecurity and data privacy programs against the SCF control catalog. Used by internal audit teams and third-party assessors to produce consistent, repeatable assessment results.

CDPAS enables organizations to self-assess against the CCF™ using a structured observation-based methodology, producing defensible evidence of control effectiveness for regulators, insurers, and board audiences.

Evidence Request List (ERL)

The ERL is a pre-built, comprehensive list of audit evidence items mapped to every SCF control. It tells auditors, assessors, and compliance teams exactly what documentation, configurations, and artifacts are needed to demonstrate control effectiveness.

The ERL eliminates the "what do you want to see?" ambiguity in audits. Both the assessed organization and the assessor start from the same, standardized evidence baseline — dramatically reducing audit preparation time and rework.

Unified Scoping Guide (USG)

The USG provides structured guidance for defining assessment scope — the critical first step in any audit or compliance assessment. Proper scoping determines which systems, data flows, and processes are in-scope for each applicable law or framework.

The USG prevents both over-scoping (wasting resources assessing out-of-scope systems) and under-scoping (missing critical systems and creating audit exposure). It is essential for FedRAMP, PCI DSS, HIPAA, and SOC 2 engagements.