SCF Free Content

Unified Scoping Guide

A free, data-centric resource for defining the scope of sensitive data environments — helping organizations identify where sensitive data is stored, transmitted, and processed.

Scoping Zones

Data Types Covered

⬇ Download the USG Explore Additional SCF Content

Overview

What Is the USG?

The Unified Scoping Guide (USG) is a free resource intended to help organizations define the scope of sensitive data where it is stored, transmitted, and/or processed. The guide refers to both sensitive and regulated data as “sensitive data” to simplify the concept.

This scoping guide categorizes system components according to several factors:

✓

Whether sensitive data is being stored, processed, or transmitted

✓

The functionality that the system component provides (e.g., access control, logging, antimalware, etc.)

✓

The connectivity between the system and the sensitive data environment

Zones for Sensitive Data Compliance

Data-Centric Security

Applicable Sensitive Data Types

The USG’s data-centric security approach is applicable to the following sensitive data types — any type of data that requires protection due to regulatory, contractual, or organizational requirements.

CUI

Controlled Unclassified Information

PII

Personally Identifiable Information

CHD

Cardholder Data

ACPI

Attorney-Client Privilege Info

ITAR

Export-Controlled Data (ITAR / EAR)

FCI

Federal Contract Information

PHI

Protected Health Information

Intellectual Property

FERPA

Student Educational Records

CII

Critical Infrastructure Information

Scope & Limitations

What the Guide Covers

What the USG Does Address

✓

Assists in determining which system components fall in and out of scope

✓

Facilitates constructive communication between your organization and an assessor/regulator by providing a reasonable methodology to describe your technology infrastructure

✓

Provides a means to categorize different types of assets, each with a different risk profile

✓

Provides a starting point to potentially reduce the scope of sensitive data by re-architecting technologies to isolate and control access

What the USG Does Not Address

Does not define which statutory, regulatory, and/or contractual controls are required for each category

Since every organization is different, it is up to each organization and its assessor to determine the nature, extent, and effectiveness of each control

For defining control applicability, see the Integrated Controls Management (ICM) model

Key Capabilities

How the USG Helps Your Organization

🎯

Determine In-Scope vs Out-of-Scope Components

The USG provides clear criteria for identifying which system components are within the boundary of your sensitive data environment and which fall outside of it.

🗣️

Facilitate Communication with Assessors

Provides a common, reasonable methodology for describing your technology infrastructure and sensitive data environment to assessors and regulators.

📊

Categorize Assets by Risk Profile

Offers a structured approach to categorize different types of assets, where each type has a different risk profile associated with it.

🔒

Reduce Scope Through Re-Architecture

Provides a starting point for potentially reducing your sensitive data scope by re-architecting technologies to isolate and control access to the sensitive data environment.

🧩

Zone-Based Compliance Model

Uses a nine-zone model for sensitive data compliance purposes, helping organizations visualize and manage the boundaries and connections within their data environment.

Unified Scoping Guide

What Is the USG?

Applicable Sensitive Data Types

What the Guide Covers

How the USG Helps Your Organization

Download the USG Today