New Release • SCF 2026.2
The SCF Council is pleased to announce the release of the latest version of the Secure Controls Framework (SCF). There are two big announcements that are worth noting in this release. The first is the addition of the Quantum Security (QTS) domain to address the threat of Post-Quantum Cryptography (PQC). The second is about the Set Theory Relationship Mapping (STRM) project, where all laws, regulations and frameworks now have published STRM (with the exception of NIST 800-53 Rev4 [deprecated] and SIG [Santa Fe Group provides their mappings to the SCF]). The transparency and auditability associated with STRM makes the SCF unrivaled as a control framework for organizations to demonstrate secure, compliant and resilient capabilities.
Legacy mappings now have STRM based on NIST IR 8477.
Updated maturity model and implementation guidance.
Updated compensating controls guidance.
Full release notes on the SCF Blog →
While the PDF versions of the STRM are free (scroll down the page to see them), the SCF offers editable Excel versions of all STRM mappings. The bundle of Excel versions is $25 (access to redownload is available for 30 days from date of purchase).
SCF 2026.2 in Excel/CSV and JSON (NIST OSCAL). Both versions are part of the load file. Import into your GRC platform or use standalone.
Available formats: Excel / XLSX • JSON (OSCAL)
Individual credentials & org-level assessments across NIST CSF 2.0, NIST 800-171 R3, HIPAA, NY DFS, and more.
Individual Certifications | SCF CAP — Organization-Level Assessments →
Quality SCF-based policies, standards, procedures, metrics and more - no AI-slop, just expert-derived content to keep your organization secure, compliant and resilient. In honor of America's 250th birthday, ComplianceForge is offering a limited-time 25% discount.
Discount code: AMERICA250 (one use per organization)
%20(white).png)
.png)