.png)
Sharing Knowledge to Improve Cybersecurity for Everyone
Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
Acknowledge it or not, cybersecurity is a protracted war on an asymmetric battlefield. The threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts.
We have the ambitious goal of providing cybersecurity and data protection control guidance to cover the strategic, operational and tactical needs of organizations, regardless of its size, industry or country of origin. The end state is to help companies become and stay secure, compliant and resilient.
The glue that binds secure, compliant and resilient capabilities together is a uniform set of controls. However, in most organizations, there is no common controls set across IT, cyber privacy, procurement, etc. That leads to poor governance practices and an overall weaker state of security and data protection capabilities.
Expert-Derived Content
The end product of the SCF is “expert-derived content” created by auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe cybersecurity and data privacy on a daily basis.
A Powerful Catalyst for Cybersecurity & Data Protection
Our mission is to be a powerful catalyst that advances how cybersecurity and data protection controls are utilized at the strategic, operational and tactical layers of an organization. Regardless of its size or industry, the desired outcome is secure, compliant and resilient capabilities that are able to withstand external scrutiny.
SCF Goals
The SCF Council has a few humble goals:
From a framework perspective, become the leading metaframework that organizations can use as a “Rosetta Stone” to build secure and compliant cybersecurity and data privacy programs.
From a process improvement perspective, leverage the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP) to fundamentally disrupt/reform how cybersecurity third-party assessments are performed.
What “Free. Always.” Means
No registration or account required to download
Creative Commons licensing: use commercially
No subscription tier, no freemium upsell
Full content, not a lite or limited version
Available in .xlsx, .csv, and NIST OSCAL JSON
Like What You See?
The SCF is a community-run project that is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on Governance, Risk and Compliance (GRC) and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is “expert-derived content” that makes up the SCF.
As this is a community-run project, we accept donations because it helps advance the efforts to continue growing the SCF. If you would like to donate and help grow the SCF, you can do so below, and we are grateful for your support!
%20(white).png)