02 / Build / Secure Controls Framework
Build Once.Comply Many.
The Secure Controls Framework (SCF) gives you one practical set of controls.
The SCF gives organizations one practical set of security and privacy controls to work from, then maps that set to the laws, regulations, and standards that apply to the business.
SCF in plain language
One control set is easier to understand, maintain, and improve than a separate program for every framework.
SCF is a free, community-maintained cybersecurity and privacy meta-framework. It brings together more than 1,400 controls and maps them to more than 200 laws, regulations, and frameworks, including NIST, CMMC, HIPAA, PCI-DSS, SOC 2, ISO 27001, and GDPR.
- 1,400+ security and privacy controls
- 200+ laws and frameworks mapped
- 1 backbone for the program
SCF is not a certification standard itself. It is a way to organize internal controls and multi-framework compliance so the work is connected instead of repeated.
First-hand knowledge changes the work
William Birchett is an SCF Fellow and was the first person in the world to earn all three SCF certifications: Certified Assessor, Practitioner and Architect. He also serves on the SCF Advisory Board, and Logos Systems is a preferred SCF consultant. That gives clients close, practical knowledge of how the framework works and how to use it as the backbone of a risk and compliance program.
- Less duplication. Connect obligations to shared controls instead of rebuilding the same work for every audit or requirement.
- More useful decisions. See what matters now, what evidence is missing, and how the program can improve over time.
How we use SCF
The framework is useful when it becomes part of the way the program is run, not another document on a shelf.
- Design one control set. Build a practical set of controls around your systems, risks, people, and business goals.
- Map your obligations. Connect that control set to the laws, regulations, contracts, and frameworks your organization needs to address.
- Find and close gaps. Use gap analysis to turn uncertainty into a prioritized plan for people, process, technology, and evidence.
- Build the record. Create the policies, procedures, and documentation that explain how controls work and support the obligations they address.
- Measure and govern. Assess maturity using SCF’s criteria, then keep the control set current through ongoing governance and improvement.
Where SCF fits in your compliance work
- CMMC Readiness and NIST 800-171 and DFARS 7012
- HIPAA Compliance
- SOC 2 Readiness
- PCI DSS Compliance
- Texas SB 2610
- vCISO Services, where your CISO owns the control set and reports on it
- Compliance Support, the overview of all frameworks
Common questions
Is the Secure Controls Framework a certification?
No. SCF is not a certification standard. It is a free, community-maintained framework for organizing your controls and mapping them to the laws, regulations, and standards that apply to you.
Which frameworks does SCF map to?
More than 200 laws, regulations, and frameworks, including NIST, CMMC, HIPAA, PCI-DSS, SOC 2, ISO 27001, and GDPR.
Do I need to give up the framework my customers ask for?
No. You still meet each framework your customers, regulators, or contracts require. SCF lets you do it from one control set instead of a separate program for each.
Give your compliance work a backbone.
Talk with Logos about SCF, CMMC, vCISO support, or the broader work of making risk easier to manage. Email [email protected] or call (877) 77-vCISO.