SCF Library Application Overview
The SCF Library application provides a unified control catalog that consolidates control definitions across 20 industry-standard compliance frameworks. These controls are derived from the Secure Controls Framework (SCF) and serve as the system of record for defining compliance requirements across domains such as data privacy, risk management, vulnerability management, and more.
Each SCF Library record represents a single framework-agnostic control and includes both read-only metadata and editable organization-specific implementation fields.
Once the desired frameworks are chosen, the solution populates a unified control catalog that encompasses all mapped controls for each framework selected.
Each unified control is stored in an SCF Library record. These framework-agnostic controls are the source of truth for external compliance guidance and come pre-populated from the SCF data.
SCF Library records include the following read-only fields to maintain the integrity and accuracy of the control catalog:
Application Field Name | Description |
|---|---|
SCF # | ID of the global control which is the key value that maps to all other compliance frameworks. |
SCF Control | The title of the SCF control. |
SCF Domain | Security area that the control covers which spans across 33 domains such as (Data Privacy, Risk Management, and so on). |
SCF Control Description | The description of each SCF control. |
SCF Control Question | A question that the control information should answer. |
Relative Control Weighting | Number: Relative weighting assigned by the SCF to each control. |
Total Mapped Framework Controls | Number: The sum of all framework-specific controls that the global control maps to. |
SCRM Focus | Multi-selection: Supply Chain Risk Management Focus:
|
PPTDF Applicability | Single-selection: Value from NIST CSF:
|
NIST CSF Function Grouping | Control Function coming from the NIST Cyber Security Framework 2.0:
|
SCF Library records also have editable fields used to describe how the organization implements the control. The following are editable fields:
Application Field Name | Description |
|---|---|
How we perform the control? | Rich text box for providing a write up of how the control is performed. Users have the freedom to include as much detail as they want in this field, including the use of hyperlinks to an external knowledge base or other resource. |
Control Scope | Single-select:
Note: If the “Out of Scope” value is selected an additional field populates in the record called Out of Scope Rationale which becomes mandatory to explain why the control is excluded from the scope. |
Control Status | Single-select:
|
Control Type | Single-select:
|
Control Frequency | Single-select:
|
Control Automation | Single-select:
|
Control Owner | This field is organization-specific as it pertains to the team or individuals in the organization responsible for implementing the control. For more information on how to configure this field see How to Use the SCF Library Application. |
How to Use the SCF Library Application
Each SCF Library record guides users through a structured process to ensure complete documentation and traceability of compliance controls.
Step 1: Assign Control Owner
Populate the Control Owner field with the email address of the stakeholder accountable for maintaining the control.
Step 2: Answer Control Question
Use the SCF Control Answer field to describe the organization’s approach to satisfying the control’s intent. Include procedural, technical, or policy-based details.
Step 3: Set Control Metadata
Update the following fields to reflect your organization's implementation status:
- Control Scope (In/Out of Scope)
- Control Status (for example, Not Started, Ready)
- Control Frequency
- Control Automation
This data feeds directly into SCF Reporting and determines readiness scoring across frameworks.
Step 4: Manage & Updated Referenced Evidence
If applicable, link evidence records via the Referenced Evidence section at the bottom of the record. You can associate one or more SCF Evidence records (for example., SCFE-200, SCFE-212) that support the implementation claim.