Scf Common Controls And Evidence Management
This connector facilitates the management of security controls and evidence by providing access to the Secure Controls Framework data.
The SCF Common Controls and Evidence Management connector streamlines compliance processes by integrating with the Secure Controls Framework (SCF), a comprehensive catalog of controls and evidence management practices. It enables users to obtain the latest SCF data, manage controls, and handle evidence within their security environment, either by using a user-uploaded SCF Excel file or fetching the official SCF file based on the specified version. This integration facilitates the alignment of security measures with various frameworks and standards, ensuring a robust compliance posture and simplifying evidence collection for audits within the Swimlane Turbine platform.
Limitations
This connector has been verified on Turbine 25.0.2 & SCF version 2024.3 & 2024.4.
Supported Versions
- Version 2024.4 represents a minor update, based on new and changed controls. The SCF had a minor formatting change that changed bullet listings to numbered listings.
Configuration
Prerequisites
To effectively use the SCF Common Controls and Evidence Management connector, ensure you have the following:
- Configuration for SCF Version with these parameters:
- Version: Specify the version of the SCF you wish to use.
- Selected Frameworks: Choose the frameworks from SCF relevant to your organization.
- Verify SSL Certificates: Determine whether to enforce SSL certificate verification.
Authentication Methods
SCF Configuration Management Authentication:
- Configure & Set SCF Version with these parameters:
- Version: Specify the version of the SCF you wish to use.
- Selected Frameworks: Choose the frameworks from the SCF that are relevant to your organization.
- Verify SSL Certificates: Determine whether to enforce SSL certificate verification for secure communication.
- Use File: Set to true to use the user-uploaded Excel file; set to false to fetch the official SCF file based on the specified version.
Capabilities
This Connector provides the following capabilities:
- Get SCF Data
- Get SCF Common Controls Data Action:
- Connects to one of the following sources:
- A user-uploaded SCF Excel file if use_file is set to true (you must upload the file).
- Otherwise, connects to the SCF GitHub repository at:
- Downloads the versioned artifact.
- Transforms the artifact data to normalized application record values.
- Supported Frameworks:
- AICPA TSC 2017-2022 SOC 2
- APAC Australia Essential 8
- APAC Japan ISMAP
- COBIT 2019
- CSA CCM v4
- EMEA EU DORA
- EMEA EU GDPR
- EMEA EU NIS2
- IEC 62443-4-2
- ISO 27001 v2022
- ISO 27002 v2022
- ISO 27701 v2019
- ISO 42001 v2023
- NIST 800-53 rev5 ... and so on
Configurations
SCF Configuration Management
Configure & Set SCF Version
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
version | SCF version to use. Format is YYYY.Q only. | string | Required |
selected_frameworks | ο»Ώ | array | Required |
verify_ssl | Verify SSL certificate. | boolean | Required |
use_file | Set to true to use the user-uploaded Excel file; set to false to fetch the official SCF file based on the specified version. | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
xtnd_selected_frameworks | Allows ingestion from frameworks not available in Selected Frameworks options. These values must match the column header values exactly. | array | Optional |
xtnd_additional_columns | Allows ingestion from additional columns. These values must match the column header values exactly. | array | Optional |
Actions
Get SCF Data
Obtain the latest Secure Controls Framework data to manage controls and evidence within your security environment.
Endpoint
- Method: python_311_definition
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
files | object | Optional | A file attachment. Upload the SCF Excel file to be processed when use_file is set to true. The file must be a valid Secure Controls Framework (SCF) Excel artifact. |
files.file | string | Optional | Parameter for Get SCF Data |
files.file_name | string | Optional | Name of the resource |
use_file | boolean | Optional | Set to true to use the user-uploaded Excel file; set to false to fetch the official SCF file based on the specified version. |
Input Example
{"files":{"file":"string","file_name":"Example Name"},"use_file":true}
Output
Parameter | Type | Description |
|---|---|---|
log | array | Output field: log |
library_record_data | array | Response data |
library_record_data.aicpa-tsc-2017-2022-soc-2 | array | Response data |
library_record_data.apac-japan-ismap | array | Response data |
library_record_data.cobit-2019 | array | Response data |
library_record_data.csa-ccm-v4 | array | Response data |
library_record_data.emea-eu-dora | array | Response data |
library_record_data.emea-eu-gdpr | array | Response data |
library_record_data.emea-eu-nis2 | array | Response data |
library_record_data.evidence-request-list-erl-id | array | Response data |
library_record_data.iso-27001-v2022 | array | Response data |
library_record_data.iso-27002-v2022 | array | Response data |
library_record_data.iso-27701-v2019 | array | Response data |
library_record_data.iso-42001-v2023 | array | Response data |
library_record_data.nist-800-53-rev5 | array | Response data |
library_record_data.nist-csf-function-grouping | string | Response data |
library_record_data.nist-csf-v2.0 | array | Response data |
library_record_data.pci-dss-v4.0 | array | Response data |
library_record_data.pptdf-applicability | string | Response data |
library_record_data.relative-control-weighting | string | Response data |
library_record_data.scf-control | string | Response data |
library_record_data.scf-control-question | string | Response data |
library_record_data.scf-domain | string | Response data |
library_record_data.scf-id | string | Response data |
library_record_data.scrm-focus | array | Response data |
Output Example
{"log":[],"library_record_data":[],"evidence_record_data":[]}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |