.png)
Purpose-Built Baselines For Every Organization
The full SCF covers a wide range of cybersecurity, data privacy and resilience requirements. Most organizations need a focused subset that fits their size, industry and risk. SCF CORE meets that need with tailored baselines derived from the Common Controls Framework (CCF).
Because every baseline is built from the same SCF controls, an organization can move from one baseline to another, or meet several at once, without duplicating work.
Each baseline is summarized below, with a link to its own page for more detail.
Volunteer-Driven & Creative Commons Licensed
SCF CORE content is developed by volunteers and released under a Creative Commons license, so it is free to use.
Essential Cybersecurity for Small & Medium Businesses
SCF CORE Fundamentals is a focused set of SCF controls for small and medium businesses that need a practical place to start. It covers the administrative, technical and physical safeguards that do the most to protect sensitive data, without the overhead of an enterprise control set.
Smaller organizations face the same threats as large enterprises with far fewer people and less budget. Fundamentals gives them a defined, defensible program they can implement and document. It was also built with Texas SB 2610 in mind. The law names the SCF among the recognized frameworks that Texas businesses with fewer than 250 employees can use to limit exemplary damages after a data breach.
What SCF CORE Fundamentals Should Achieve
- A documented security program with clear ownership and published policies
- Strong protection for accounts, devices and sensitive data
- The ability to detect, respond to and recover from incidents
- Evidence that the program exists and operates, ready for a customer, insurer or assessor
- A consistent baseline for assessing smaller vendors
Cybersecurity Due Diligence for Mergers, Acquisitions & Divestitures
SCF CORE MA&D is a set of SCF controls for evaluating the cybersecurity and data protection posture of an organization involved in a merger, acquisition or divestiture. Buyers, targets and assessors all work from the same control set.
A buyer inherits the target's security weaknesses, data obligations and technical debt along with the business. When due diligence relies on custom questionnaires that change from deal to deal, findings are hard to compare and easy to dispute. A shared baseline brings cybersecurity risk into the deal while there is still time to price it and plan for it.
What SCF CORE MA&D Should Achieve
- A clear view of the cybersecurity risk the buyer is inheriting
- Findings that are consistent and comparable from one deal to the next
- Remediation costs that can be considered in the deal terms
- A security plan for the period after close, when cybersecurity risk often increases
Security Expectations for MSPs & MSSPs
The SCF CORE External Service Provider (ESP) baselines define the security, compliance and resilience practices expected of Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs). Three levels let a provider match its protections to the clients it serves and the threats those clients face.
MSPs and MSSPs often hold privileged access to many client environments at once, so a weakness at one provider can affect every organization it supports. The ESP baselines were developed with the Cyber Accreditation Body (Cyber AB) and the ESP Collective to give providers a reasonable, defined standard of practice that clients, insurers and regulators can recognize.
What The ESP Baselines Should Achieve
- Protection of the privileged access a provider holds into client environments
- A level of practice that matches the provider's clients and threat exposure
- Credibility with clients that hold regulated data or run critical operations
- One set of SCF controls that addresses overlapping client requirements
Demonstrable Assurance for Service Organizations
The SCF CORE Modern Services Organization (MSO) baselines define the security, compliance and resilience practices customers should reasonably expect from the service organizations they rely on. Three progressive levels, MSO-1, MSO-2 and MSO-3, align those expectations with an organization's complexity, risk exposure and operational capability. The MSO baselines are currently in Initial Public Draft.
Threats, technology and customer expectations have changed considerably since SOC 2 and ISO 27001 became the established approaches to security assurance. Customers now want evidence that safeguards are implemented, operating and able to support resilient operations. MSO builds on established assurance concepts and is designed to work alongside existing SOC 2 reports and ISO 27001 certificates.
What The MSO Baselines Should Achieve
- Reasonable, proportionate expectations for secure and resilient service delivery
- Evidence that controls are implemented and operating within a defined assessment boundary
- Independent assessment results that customers can evaluate for themselves
- Reuse of existing controls and evidence across frameworks
Governance & Oversight for AI in Daily Operations
SCF CORE AI-Enabled Operations is a set of SCF controls for organizations that use AI systems and AI agents to run parts of their business, whether they build those systems or buy them from a vendor.
AI agents can now take actions on their own, call other tools and pass work to other agents. Each of those capabilities introduces risks that traditional security controls were not written for. This baseline gives organizations a defined way to govern the AI they use and to show customers and regulators that AI-driven operations are under control.
What SCF CORE AI-Enabled Operations Should Achieve
- People who can monitor, intervene in and stop AI systems and AI agents when needed
- AI agents that operate within defined permissions, data access and tool limits
- AI actions that are logged, traceable and explainable after the fact
- Early detection of performance changes, anomalies and behavioral drift
Responsible AI From Development Through Release
SCF CORE AI Model Deployment is a set of SCF controls for organizations that develop, fine-tune or deploy AI models. It covers the full lifecycle, from defining a model's purpose and assessing its impact through testing, documentation, release and ongoing monitoring.
An AI model's risks are largely decided while it is being built, and problems found after release are harder and more expensive to fix. AI laws increasingly expect organizations to show this work before a model reaches users. The SCF maps these controls to requirements such as the EU AI Act, the NIST AI RMF and ISO/IEC 42001, so one set of practices can support several obligations.
What SCF CORE AI Model Deployment Should Achieve
- A documented business case, intended use and impact assessment for each model
- Testing for trustworthiness, safety, security and fairness before release
- Safeguards on model outputs and protection against model pollution and misuse
- Monitoring, documentation and human oversight once a model is in use
Independent Assessment Through SCR CAP
SCF CORE baselines are designed to be assessed by independent third parties through the SCR Conformity Assessment Program (SCR CAP). Accredited Third-Party Assessment Organizations (3PAOs) evaluate each control using the examine, interview and test methodology, so customers and partners receive documented evidence of how an organization's controls operate.
%20(white).png)