.png)
Growth Over Time
How The SCF Has Grown
Each chart covers every release from 2018.1 to the current release. Choose what to look at: total controls, the laws, regulations and frameworks the SCF maps to, how many of those have a published Set Theory Relationship Mapping (STRM), or how each domain has grown.
The charts are drawn from the release list on this page.
Release History
Every SCF Release, Newest First
Releases are grouped by year. Select any release to see what changed, along with its control and framework counts. Each release is sized by how much it changed:
Major
large or structural changes
Moderate
notable new content
Minor
incremental updates
Maintenance
corrections only
Release
Published
Scale
Summary
2026.3
Sep 21, 2026
Major
A de-duplication and regrouping release: most controls are renumbered, with legacy numbers built into the spreadsheet, and the SCF now maps to 270 laws, regulations and frameworks.
- 1,457 controls renumbered and 99 moved to a different domain, with current to legacy numbers in the download.
- 80 new controls; 185 renamed and 204 wordsmithed.
- 23 legacy controls merged into 22 existing controls.
- Risks and threats now mapped to each control as Likely, Possible or Unlikely.
- 25 laws, regulations and frameworks added, including Germany C5 (2026), Singapore CCP CII (2026), four Reserve Bank of India directions and Texas TRAIGA; 6 retired or replaced by newer versions.
- The 34 domains are unchanged.
2026.3
2026
20260300
1591
80
270
268
34
{"AAT":160,"AST":64,"BCD":61,"CAP":8,"CFG":58,"CHG":20,"CLD":19,"CPL":48,"CRY":27,"DCH":94,"EMB":27,"END":31,"GOV":37,"HRS":45,"IAC":123,"IAO":17,"IRO":48,"MDM":10,"MNT":29,"MON":76,"NET":103,"OPS":11,"PES":51,"PRI":102,"PRM":15,"QTS":31,"RSK":35,"SAT":22,"SEA":40,"TDA":74,"THR":17,"TPM":43,"VPM":32,"WEB":13}
scf-2026-3
Sep 21, 2026
185
204
23
2026.2
Jul 8, 2026
Moderate
Adds the Quantum Security (QTS) domain, and every mapped law, regulation and framework now has published STRM, apart from NIST 800-53 Rev4 and SIG.
- New QTS domain with 34 controls, bringing the SCF to 34 domains.
- 66 new controls in total, 10 renamed and 21 wordsmithed.
- STRM published for every mapped law, regulation and framework except NIST 800-53 Rev4 (deprecated) and SIG (mapped by the Santa Fe Group).
- Updated maturity criteria, possible solutions and compensating controls.
2026.2
2026
20260200
1534
66
254
250
34
{"AAT":161,"AST":64,"BCD":59,"CAP":6,"CFG":32,"CHG":20,"CLD":24,"CPL":41,"CRY":29,"DCH":85,"EMB":19,"END":47,"GOV":42,"HRS":46,"IAC":116,"IAO":15,"IRO":44,"MDM":11,"MNT":28,"MON":71,"NET":100,"OPS":8,"PES":51,"PRI":103,"PRM":11,"QTS":34,"RSK":33,"SAT":18,"SEA":47,"TDA":74,"THR":15,"TPM":31,"VPM":34,"WEB":15}
scf-2026-2
Jul 8, 2026
10
21
0
2026.1.1
Apr 22, 2026
Maintenance
Restores missing trailing zeros in seven ISO 27002:2022 references.
- ISO 27002:2022 references 5.10, 5.20, 5.30, 7.10, 8.10, 8.20 and 8.30 corrected.
2026.1.1
2026
20260101
1468
0
253
185
33
scf-2026-1-1
Apr 22, 2026
0
0
0
2026.1
Apr 1, 2026
Moderate
The program language moves to Security, Compliance & Resilience, with 17 new controls, proposed compensating controls, 13 authoritative sources added and 24 retired.
- Governance controls renamed around the Security, Compliance & Resilience Program (SCRP); 42 renamed and 114 wordsmithed.
- 17 new controls, including FOCI, WORM event logs and mutual authentication.
- Proposed compensating controls, plus updated maturity criteria and possible solutions.
- 13 sources added, including IEC 62443-2-1 (2024), OWASP Top 10 (2025), CJIS v6.0 and SIG 2025.
- 24 sources retired, including FedRAMP R4, FFIEC, HICP and ITAR.
2026.1
2026
20260100
1468
17
253
185
33
scf-2026-1
Apr 1, 2026
42
114
0
2025.4
Dec 29, 2025
Minor
Adds PPTDF applicability to Assessment Objectives, 31 new privacy and risk controls, and 12 new laws, regulations and frameworks.
- Assessment Objectives now tagged by People, Process, Technology, Data or Facility (PPTDF).
- 31 new controls, led by Data Privacy (PRI, 22), covering automated decision-making, data brokers and opt-out rights, plus 7 risk management controls.
- 12 added, including ISO 27701:2025, ISO 29100:2024, SIG 2025, GovRAMP, CCPA 2025 and India SEBI CSCRF.
- 6 retired: ISO 27001:2013, ISO 27002:2013, ISO 29100:2011, NIST CSF 1.1, PCI DSS 3.2 and SIG 2023.
2025.4
2025
20250400
1451
31
261
103
33
scf-2025-4
Dec 29, 2025
2
23
0
2025.3.1
Oct 22, 2025
Maintenance
Minor edits to CMMC Level 1 mappings to match its numbering format.
- CMMC Level 1 references updated to the new numbering format.
2025.3.1
2025
20250301
1420
0
259
86
33
scf-2025-3-1
Oct 22, 2025
0
0
0
2025.3
Oct 1, 2025
Major
78 new controls, mostly AI agent governance, and seven new control sets, including the SCF CORE baselines.
- 78 new controls, led by Artificial Intelligence & Autonomous Technologies (AAT, 42), covering AI agents, prompt injection, kill switches and model resilience.
- New governance controls for assurance levels and mergers, acquisitions & divestitures.
- New control sets: Conformity Validation Cadence (CVC), SCF CORE Community Derived, CORE ESP Levels 1 to 3, CORE AI-Enabled Operations and CORE AI Model Deployment.
- 34 renamed and 271 wordsmithed.
- STRM added for Texas SB 2610.
2025.3
2025
20250300
1420
78
258
85
33
scf-2025-3
Oct 1, 2025
34
271
0
2025.2.2
Jul 22, 2025
Minor
Introduces the SCF CORE Fundamentals and MA&D baselines and corrects NZ HISF and CMMC Level 2 mappings.
- New SCF CORE baselines: Fundamentals, and Mergers, Acquisitions & Divestitures (MA&D).
- New Zealand HISF 2022 mapping corrected for 18 controls.
- CMMC Level 2 mappings aligned with the NIST 800-171 R2 STRM.
- UK GDPR mapping retired as redundant with the EU GDPR STRM.
2025.2.2
2025
20250202
1342
0
255
80
33
scf-2025-2-2
Jul 22, 2025
2
4
0
2025.2.1
Jul 9, 2025
Maintenance
Corrects AAT domain mappings for NIST AI 600-1 and the EU AI Act.
- AAT control corrections following STRM fixes for NIST AI 600-1 and the EU AI Act.
2025.2.1
2025
20250201
1342
0
255
80
33
scf-2025-2-1
Jul 9, 2025
0
0
0
2025.2
Jul 7, 2025
Major
78 new controls focused on AI governance, with STRM for the EU AI Act, EU Cyber Resilience Act and NERC CIP.
- 78 new controls, led by Artificial Intelligence & Autonomous Technologies (AAT, 47), including prohibited AI practices such as social scoring and emotion inference.
- New GOV-18 Quality Management System (QMS) control.
- 9 renamed and 22 wordsmithed.
- STRM added or updated for the EU AI Act, EU Cyber Resilience Act, ENISA NIS2 annex, NIST AI 100-1, NIST AI 600-1, NERC CIP (2024), NAIC MDL-668 and NIST 800-171 R3.
2025.2
2025
20250200
1342
78
255
80
33
scf-2025-2
Jul 7, 2025
9
22
0
2025.1.1
Apr 7, 2025
Maintenance
Adds the India DPDPA column that was missing from the main spreadsheet.
- India Digital Personal Data Protection Act (DPDPA) column added.
2025.1.1
2025
20250101
1264
0
250
71
33
scf-2025-1-1
Apr 7, 2025
0
0
0
2025.1
Mar 30, 2025
Minor
23 new controls, mostly data privacy, with STRM for 10 laws and frameworks, including the EU GDPR and India DPDPA.
- 23 new controls, led by Data Privacy (PRI, 10), plus compliance, HR and patching controls.
- 19 renamed and 37 wordsmithed.
- STRM added for the EU GDPR, India DPDPA, Saudi Arabia PDPL, UAE NIAF, UK Def Stan 05-138, the US Data Privacy Framework and the Oregon and Texas privacy acts.
- 10 older privacy laws retired, including the EU ePrivacy Directive.
2025.1
2025
20250100
1264
23
250
71
33
scf-2025-1
Mar 30, 2025
19
37
0
2024.4
Dec 30, 2024
Minor
Adds STRM for the HIPAA Security Rule, CIS CSC 8.1 and CISA guidance.
- STRM added for the HIPAA Security Rule (NIST SP 800-66 R2), HIPAA Administrative Simplification, CIS CSC 8.1, CISA Cybersecurity Performance Goals and the CISA Secure Software Development Attestation Form.
- Older HIPAA, NIST 800-66 and CIS CSC 8.0 columns retired.
- 2 new controls, 3 renamed and 9 wordsmithed.
2024.4
2024
20240400
1241
2
250
40
33
scf-2024-4
Dec 30, 2024
3
9
0
2024.3
Sep 25, 2024
Minor
Adds possible solutions by business size and new supply chain risks and threats.
- Possible solutions and considerations now cover BLS firm size classes 1 to 9.
- 6 new supply chain risks and 7 new threats, including Foreign Ownership, Control or Influence (FOCI), Sanctions and Counterfeit Products.
- 5 new controls, including TDA-01.4 DevSecOps and NET-06.7 Software Defined Networking; 10 renamed and 6 wordsmithed.
- STRM added for PCI DSS v4, CIS CSC 8.0, CMMC Level 1, NIST 800-171A, TISAX ISA v6.0.3, Australia ISM June 2024 and New Zealand HISF 2022.
2024.3
2024
20240300
1239
5
252
37
33
scf-2024-3
Sep 25, 2024
10
6
0
2024.2.1
N/A
Maintenance
Restores the descriptions of 13 Asset Management controls that the 2024.2 spreadsheet had replaced with one repeated description.
- Restored the original descriptions of AST-02, AST-02.1 to AST-02.11 and AST-03. In the 2024.2 spreadsheet all 13 read "Mechanisms exist to maintain a current list of approved technologies (hardware and software)."
- No new controls, renamed controls or mapping changes.
2024.2.1
2024
20240201
1234
0
243
27
33
scf-2024-2-1
N/A
0
0
0
2024.2
May 23, 2024
Moderate
Adds People, Process, Technology, Data and Facility (PPTDF) applicability tags and the SCF-M MSP/MSSP Secure Practices Baseline.
- Every control tagged by PPTDF applicability.
- New SCF-M baseline for supply chain risk assessments of MSPs and MSSPs.
- 5 new controls, 10 renamed and 23 wordsmithed.
- Final NIST 800-171 R3 and 800-171A R3 mappings, plus NY DFS 500 Amendment 2.
2024.2
2024
20240200
1234
5
243
27
33
scf-2024-2
May 23, 2024
10
23
0
2024.1.1
Apr 4, 2024
Maintenance
Corrects the AICPA TSC 2017 mapping, which was missing content in 2024.1.
- Restored the missing Trust Services Criteria (TSC) 2017 mapping content.
2024.1.1
2024
20240101
1229
0
243
23
33
scf-2024-1-1
Apr 4, 2024
0
0
0
2024.1
Mar 27, 2024
Minor
The SCF begins using Set Theory Relationship Mapping (STRM) per NIST IR 8477 and maps to NIST CSF 2.0, DORA, NIS2 and ISO 42001.
- First release to use STRM to describe how controls relate to each law, regulation and framework.
- 45 new controls, led by Network Security (NET, 20); 9 wordsmithed.
- New mappings include NIST CSF 2.0, NIST SP 800-207, the DoD Zero Trust Reference Architecture, DORA, NIS2, ISO 42001, the SEC Cybersecurity Rule, NY DFS 500 (2023) and CJIS 5.9.3.
2024.1
2024
20240100
1229
45
243
23
33
scf-2024-1
Mar 27, 2024
0
9
0
2023.4
Dec 4, 2023
Minor
New controls for hosted systems and authentication, three new threats, and mappings for NIST 800-171 R3 drafts and automotive standards.
- 9 new controls, including CLD-13 Hosted Systems, Applications & Services and IAC-01.2 Authenticate, Authorize and Audit (AAA).
- 8 renamed and 15 wordsmithed.
- New threats: Willful Criminal Conduct, Conflict of Interest and Macroeconomics.
- New mappings include CIS CSC v8.0 IG1 to IG3, ISO/SAE 21434, UNECE WP.29, NIST SP 800-82, the NIST 800-171 R3 drafts, Germany BAIT and APRA CPS 230.
2023.4
2023
20230400
1184
9
236
33
scf-2023-4
Dec 4, 2023
8
15
0
2023.3.1
Oct 2, 2023
Maintenance
Minor mapping corrections to the 2023.3 release.
- Added NIS2 Article 21.2(i) to AST-01 and IAC-01.
- Added CIS 8.0 safeguards to AST-01 and AST-02, and corrected a CIS typo on MON-02.
2023.3.1
2023
20230301
1175
0
229
33
scf-2023-3-1
Oct 2, 2023
0
0
0
2023.3
Sep 19, 2023
Minor
Updates the risk and threat catalogs to support materiality decisions and adds mappings for NIS2, FedRAMP R5 and the SEC cybersecurity rule.
- Risk and threat models updated to help with materiality decisions.
- Terminology standardized, including External Service Provider (ESP) in place of Third-Party Service Provider (TSP).
- 7 new controls, including Risk Appetite and Threat Catalog; 30 renamed and 11 wordsmithed.
- New mappings include NIS2, FedRAMP R5, the draft NIST CSF 2.0, the SEC Cybersecurity Rule, the EU-US Data Privacy Framework, MITRE ATT&CK and the PCI DSS SAQs.
2023.3
2023
20230300
1175
7
229
33
scf-2023-3
Sep 19, 2023
30
11
0
2023.2
Apr 24, 2023
Minor
A full refresh of the Security & Privacy Capability Maturity Model (SP-CMM), with no new controls.
- SP-CMM content rewritten for every control.
- New mappings for AICPA TSC 2017 points of focus, UK Cyber Assessment Framework v3.1 and Naval Nuclear Propulsion Information (NNPI).
- 174 existing mappings updated.
2023.2
2023
20230200
1168
0
195
33
scf-2023-2
Apr 24, 2023
0
2
0
2023.1
Mar 1, 2023
Major
Adds the Artificial Intelligence & Autonomous Technologies (AAT) domain and the first Assessment Objectives (AOs).
- New AAT domain with 65 controls, bringing the SCF to 33 domains.
- 78 new controls in total, 8 renamed and 21 wordsmithed.
- New Assessment Objectives (AOs) list for objective control assessments.
- New mappings include NIST AI RMF 1.0, EU DORA, CISA Cross-Sector Cybersecurity Performance Goals, Spain CCN-STIC 825 and the TSA rail security directive.
2023.1
2023
20230100
1168
78
193
33
{"AAT":65,"AST":58,"BCD":53,"CAP":4,"CFG":27,"CHG":17,"CLD":18,"CPL":13,"CRY":27,"DCH":83,"EMB":19,"END":41,"GOV":26,"HRS":40,"IAC":100,"IAO":15,"IRO":39,"MDM":11,"MNT":28,"MON":66,"NET":76,"OPS":6,"PES":49,"PRI":69,"PRM":10,"RSK":22,"SAT":14,"SEA":39,"TDA":57,"THR":8,"TPM":26,"VPM":28,"WEB":14}
scf-2023-1
Mar 1, 2023
8
21
0
2022.3
Dec 13, 2022
Minor
Introduces the Evidence Request List (ERL), adds 33 controls and maps to ISO 27001:2022, CPRA and C2M2 v2.1.
- New Evidence Request List (ERL) to standardize evidence artifact names.
- 33 new controls, including GOV-15 Operationalizing Cybersecurity & Privacy Practices and its sub-controls.
- Terminology changes, such as "sensitive data" to "sensitive/regulated data".
- New mappings include ISO 27001:2022, ISO 27017, C2M2 v2.1, CPRA, Japan ISMAP, NZISM 3.6, SIG 2023 and CMS MARS-E 2.0.
- CCPA mapping replaced by CPRA.
2022.3
2022
20220300
1090
33
189
32
scf-2022-3
Dec 13, 2022
9
8
0
2022.2.1
Jun 22, 2022
Maintenance
Corrects the PCI DSS v4.0 mapping for one control.
- PCI DSS v4.0 requirement 9.4.1.2 now maps to BCD-02.4.
2022.2.1
2022
20220201
1057
0
183
32
scf-2022-2-1
Jun 22, 2022
0
0
0
2022.2
Jun 21, 2022
Moderate
46 new controls, PCI DSS v4.0 mapping, updated control weighting and new SCF-I (Cyber Insurance) and SCF-E (Embedded Technology) control sets.
- 46 new controls, 25 renamed and 34 wordsmithed.
- Control weighting updated for 192 controls.
- New mappings include PCI DSS v4.0, NIST SP 800-82 rev2, NIST SP 800-161 rev1, OWASP Top 10 (2021), TISAX ISA v5.1.0 and SWIFT CSF v2021.
- Retired mappings include CIS CSC v7.1, CSA CCM v3.0.1 and SWIFT CSF v2019.
- Added the SCF-I and SCF-E control sets and removed SCF-G, SCF-H, SCF-M, SCF-P and SCF-T.
2022.2
2022
20220200
1057
46
183
32
scf-2022-2
Jun 21, 2022
25
34
0
2022.1
Mar 15, 2022
Moderate
Adds the Shared Assessments SIG mapping and refreshes the SCF principles around resiliency, based on Executive Order 14028 and NIST SP 800-160 vol 2.
- Shared Assessments Standard Information Gathering (SIG) mapping, developed together with Shared Assessments.
- All SCF principles reviewed and updated for resiliency.
- 5 new controls, including CLD-06.1 Customer Responsibility Matrix (CRM) and TDA-20.3 Software Escrow.
- New mappings include ISO 27002:2022, NIST SP 800-171A, NIST SP 800-218, the Colorado Privacy Act, the NY SHIELD Act, TX-RAMP, Australia Prudential Standard CPS 234 and Singapore MAS TRM 2021.
2022.1
2022
20220100
1011
5
173
32
scf-2022-1
Mar 15, 2022
2
2
0
2021.3
Nov 17, 2021
Minor
Moves to CMMC 2.0 and NIST 800-172, and adds mappings for China's Data Security Law and privacy law.
- 7 new controls, including 3 privacy controls.
- 58 controls wordsmithed and 11 renamed and wordsmithed.
- CMMC 2.0 Levels 1 to 3 replace CMMC v1.02 Levels 1 to 5, and NIST 800-172 replaces its draft.
- New mappings for the China Data Security Law (DSL) and China privacy law.
2021.3
2021
20210300
1006
7
161
32
scf-2021-3
Nov 17, 2021
12
69
0
2021.2
N/A
Minor
31 new controls, many for embedded technology, with new mappings for CIS CSC v8, CSA CCM v4, Brazil LGPD and the UK GDPR.
- 31 new controls, led by Embedded Technology (EMB, 11) and Technology Development & Acquisition (TDA, 7).
- South Africa POPIA mappings updated for 79 controls.
- New mappings include CIS CSC v8, CSA CCM v4, CSA IoT Security Controls Framework v2, Brazil LGPD, UK GDPR, New Zealand Privacy Act 2020, NIST SSDF, StateRAMP and the Virginia CDPA.
2021.2
2021
20210200
999
31
161
32
scf-2021-2
N/A
9
14
0
2021.1
N/A
Minor
Refreshes ISO 27001/27002 mappings across about 100 controls and corrects FAR 52.204-21 mappings.
- ISO 27001 and ISO 27002 mappings updated for about 100 controls.
- FAR 52.204-21 mapping corrections.
- NIST CSF mapping updates and a new Australia Privacy Principles column.
2021.1
2021
20210100
968
0
149
32
scf-2021-1
N/A
4
14
0
2020.5
N/A
Major
94 new controls and a move to the final NIST 800-53 rev5, with new mappings for CMMC levels 1 to 5, Germany C5 and IEC 62443-4-2.
- 94 new controls, led by Asset Management (AST, 19).
- NIST 800-53 rev5 (final) with low, moderate, high and privacy baselines.
- New mappings include CMMC v1.02 Levels 1 to 5, Australia ISM 2020, Germany C5:2020, New Zealand NZISM 3.4, Saudi Arabia ECC-1, IEC 62443-4-2, FAR Section 889 and CJIS 5.9.
- Several maintenance controls renamed and wordsmithed to address remote maintenance.
2020.5
2020
20200500
968
94
148
32
scf-2020-5
N/A
19
21
0
2020.4
N/A
Minor
Moves to NIST 800-171 rev2 and CMMC v1.02, and retires several outdated mappings.
- NIST 800-171 rev2 replaces rev1, and CMMC v1.02 replaces v1.0.
- Retired mappings: AICPA TSC 2016, CIS CSC v6.1, COSO 2013 and NIST 800-37 rev1.
- Removed NIST 800-171 mappings from 14 controls and draft NIST Privacy Framework items from 3 controls.
2020.4
2020
20200400
874
0
134
32
scf-2020-4
N/A
0
0
0
2020.3
N/A
Minor
A CMMC and NIST 800-171 mapping refresh, plus a new control for cryptographic key availability.
- New control CRY-08.1 for cryptographic key availability.
- CMMC mappings updated for 77 controls, and NIST 800-171 and CMMC together for 58 more.
- New mapping columns for UK Cyber Essentials and the UK Data Protection Act.
- Typo corrections in ISO and NIST Privacy Framework mappings.
2020.3
2020
20200300
874
1
138
32
scf-2020-3
N/A
0
0
0
2020.2
N/A
Minor
Adds a Security Operations Center (SOC) control and moves to the final NIST Privacy Framework and CMMC v1.0.
- New control OPS-04 for establishing a Security Operations Center (SOC).
- NIST Privacy Framework v1.0 replaces the draft, and CMMC v1.0 replaces v0.6.
- Draft NIST 800-171B mapping updates.
2020.2
2020
20200200
873
1
137
32
scf-2020-2
N/A
0
0
0
2020.1
N/A
Minor
Updates the CCPA mapping to the January 1, 2020 version of the law.
- CCPA mappings updated for 85 controls.
- California SB 327 mappings updated for 6 controls.
2020.1
2020
20200100
872
0
137
32
scf-2020-1
N/A
0
0
0
2019.7
N/A
Major
The first large expansion of the catalog: 125 new controls and new mappings for ISO 27701, COBIT 2019, FedRAMP and the draft CMMC.
- 125 new controls, led by Continuous Monitoring (MON, 22), Business Continuity & Disaster Recovery (BCD, 12), Identification & Authentication (IAC, 11) and Network Security (NET, 10).
- 58 controls wordsmithed, 23 renamed and 15 renamed and wordsmithed.
- PRI-01.2 collapsed into PRI-02.
- New mappings include ISO 27701 (2019), ISO 22301 (2019), COBIT 2019, CIS CSC v7.1, NIST 800-53 rev4 baselines, FedRAMP, CMMC v0.6 (draft), the draft NIST Privacy Framework and CJIS 5.8.
2019.7
2019
20190700
872
125
137
32
scf-2019-7
N/A
38
73
0
2019.6
N/A
Minor
Adds mappings for COSO 2017, Israel CDMO, CJIS Security Policy 5.5 and Texas SB 820.
- New mapping columns: COSO v2017, Israel CDMO v1.0, CJIS Security Policy 5.5 and Texas SB 820.
- NIST CSF v1.1 mappings updated for 8 controls.
2019.6
2019
20190600
747
0
120
32
scf-2019-6
N/A
0
2
0
2019.5
N/A
Minor
Adds mappings for SWIFT CSF 2019, IRS Publication 1075 and the SSA EIESR.
- New mapping columns: SWIFT Customer Security Controls Framework v2019, IRS Publication 1075 and SSA Electronic Information Exchange Security Requirements (EIESR) v8.0.
2019.5
2019
20190500
747
0
117
32
scf-2019-5
N/A
0
0
0
2019.4
N/A
Minor
Adds Cloud Security Alliance Cloud Controls Matrix (CSA CCM) mappings for 37 controls.
- CSA CCM v3.0.1 mappings added for 37 controls.
- Minor wording correction to GOV-04.
2019.4
2019
20190400
747
0
114
32
scf-2019-4
N/A
0
1
0
2019.3
N/A
Maintenance
No content changes were found between the archived 2019.2 and 2019.3 spreadsheets.
- The archived 2019.3 file matches 2019.2 cell for cell.
2019.3
2019
20190300
747
0
114
32
scf-2019-3
N/A
0
0
0
2019.2
N/A
Minor
Adds mappings for the Alaska Personal Information Protection Act and the California Consumer Privacy Act (CCPA).
- New mapping columns: Alaska PIPA and California CCPA (SB 1121).
- Minor ISO 27002 and EU GDPR mapping updates.
2019.2
2019
20190200
747
0
114
32
scf-2019-2
N/A
0
0
0
2019.1
N/A
Minor
Introduces the Minimum Security Requirements (MSR) filter and removes the risk and assessor columns added in 2018.1.3.
- New Minimum Security Requirements (MSR) filter column.
- Removed the risk, assessor guidance and risk question columns.
- PCI DSS v3.2 cell formatting reverted.
2019.1
2019
20190100
747
0
112
32
scf-2019-1
N/A
0
0
0
2018.1.3
N/A
Minor
Adds HIPAA HICP, NAIC MDL-668 and NIST 800-37 rev2 mappings, plus new columns for risk and assessor guidance.
- New mapping columns: HIPAA HICP (small, medium and large practice), NAIC Insurance Data Security Model Law (MDL-668), NIST 800-37 rev1 and rev2.
- New columns for risks associated with a control deficiency, basic assessor guidance and SCF-based risk questions.
- PCI DSS v3.2 mapping cells reformatted (60 controls).
2018.1.3
2018
20180103
747
0
112
32
scf-2018-1-3
N/A
0
0
0
2018.1.2
N/A
Minor
Adds mappings for several new laws and standards, including Brazil, Argentina, California SB 327 and the MPAA Content Security Program.
- New mapping columns: Argentina Reg 132/2018, Brazil, MPAA Content Security Program v4.04, California SB 327 and the South Carolina Insurance Data Security Act.
- NIST 800-53 rev5 column relabeled as a draft, and the DFARS column relabeled as DFARS Cybersecurity.
- Minor SOC 2 and ISO 27002 mapping corrections.
2018.1.2
2018
20180102
747
0
107
32
scf-2018-1-2
N/A
1
0
0
2018.1.1
N/A
Minor
Fills in AICPA SOC 2 (2017) mappings across the catalog and expands the "Methods To Comply" guidance.
- AICPA SOC 2 (2017) mappings added or updated for 278 controls.
- "Methods To Comply" examples added for 111 controls.
- Five controls renamed, including TPM-08 (Review of Third-Party Services).
- Corrected the spelling of Colombia in the Americas mapping column.
2018.1.1
2018
20180101
747
0
102
32
scf-2018-1-1
N/A
5
3
0
2018.1
N/A
Baseline
The earliest SCF release in the public GitHub archive, with 747 controls across 32 domains.
- 747 controls organized into 32 domains.
- Mapping columns for 102 laws, regulations and frameworks, including ISO 27001/27002, NIST 800-53 rev4, NIST 800-171, NIST CSF, PCI DSS and the EU GDPR.
- Includes a "Methods To Comply" column with example ways to implement each control.
2018.1
2018
20180100
747
102
32
{"AST":26,"BCD":34,"CAP":3,"CFG":22,"CHG":15,"CLD":11,"CPL":6,"CRY":18,"DCH":67,"EMB":3,"END":33,"GOV":9,"HRS":28,"IAC":77,"IAO":12,"IRO":31,"MDM":8,"MNT":15,"MON":40,"NET":54,"OPS":4,"PES":35,"PRI":40,"PRM":7,"RSK":14,"SAT":11,"SEA":34,"TDA":38,"THR":5,"TPM":18,"VPM":23,"WEB":6}
scf-2018-1
N/A
%20(white).png)