CybersecurityFramework

SCF

Secure Controls Framework

The Secure Controls Framework (SCF) is a comprehensive, free cybersecurity and data privacy metaframework designed to simplify compliance and build secure, resilient organizations. It unifies control sets to simultaneously meet compliance requirements across multiple laws, regulations, and frameworks.

Book your strategy call View source ↗

Overview

The SCF, also known as the Common Controls Framework (CCF), provides a unified control catalog with over 1,400 controls across 33 domains. It maps to over 200 unique laws, regulations, and frameworks globally, such as GDPR, HIPAA, ISO 27001, and more. The framework is created and maintained by volunteers from the cybersecurity and GRC community, ensuring transparent and rigorous methodologies like the NIST IR 8477 Set Theory Relationship Mapping (STRM). As a living control set, SCF is updated quarterly to stay relevant with evolving laws and threat landscapes. It is openly available in machine-readable formats compatible with modern GRC platforms.

Related in Cybersecurity

CybersecurityFramework

ASD Essentials for Cloud

The ASD Essentials for Cloud is an Australian cybersecurity framework that provides a threat-informed, risk-based approach for securing cloud environments, helping organizations protect cloud services, data, identities, applications, and integrations from cyber threats.

Australian Signals Directorate (ASD)

View details

CybersecurityFramework

ASD Essentials for Operational Technology (OT)

The ASD Essentials for Operational Technology (OT) is an Australian cybersecurity framework that provides risk-based guidance for securing industrial control systems, cyber-physical systems, and other operational technology environments through prioritized security principles, actions, and domains tailored to OT-specific risks and operational requirements.

Australian Signals Directorate (ASD) • Australia

View details

CybersecurityFramework

ASD Essentials for Enterprise IT

The ASD Essentials for Cloud is a cybersecurity framework developed by the Australian Signals Directorate (ASD) to help organizations protect cloud environments from sophisticated cyber threats. It provides a structured approach based on Principles, Actions, and Domains for securing SaaS and PaaS environments, with a focus on identity, data, configurations, applications, integrations, and provider assurance.

Australian Signals Directorate (ASD) • Australia

View details

CybersecurityRegulation

RFFR ISM PSP-A — RFFR ISM Provider Security Plan Annex Template

The RFFR Provider Security Plan Annex (PSP-A) Template is a DEWR security assurance template used to document the implementation and status of security controls that protect departmental information and support the secure delivery of services under the Right Fit For Risk (RFFR) framework.

Australian Government • Australia • vSeptember 2026

View details

Ready to manage these frameworks?

6clicks maps regulations to controls, evidence and risks — automatically.

Book your strategy call