Commercial License | Secure Controls Framework (SCF)

Overview

SCF Licenses Overview

In order to generate derivative content based on the SCF, an organization needs to purchase a Commercial SCF License to share and/or sell that derivative SCF content.

Standard SCF License

The Standard SCF License utilizes the Creative Commons Attribution-NoDerivatives 4.0 International Public License to help maintain the integrity of the SCF. Under that standard license, two fundamental requirements are (1) attribution and (2) no derivatives:

Attribution requires anyone using the SCF to give appropriate credit, provide a link to the license and indicate if changes were made. Providing attribution is as simple as stating SCF controls are used in the solution, such as a Governance, Risk & Compliance (GRC), or similiar technology, platform that includes SCF content is required to provide attribution that SCF controls are used; and
No Derivatives prohibits the distribution of modified SCF content. This prohibition on creating derivative works includes utilizing Artificial Intelligence (AI) (or similar technologies) to leverage SCF content to generate policies, standards, procedures, metrics, risks, threats or other derivative content.

Usage Guidance For GRC Platforms Interested In Leveraging The SCF

Many GRC platforms leverage the SCF without creating derivative works. Through the Standard SCF License, GRC platforms are granted the ability to rearrange existing SCF content as part of the user experience and support client work flows, based on how no new material is generated in that process. The SCF Council does not consider the practice of visually rearranging existing SCF content for readability purposes as creating a derivative work.

Commercial SCF License

The SCF currently offers two (2) versions of commercial licensing:

Tier 1 SCF Commercial License; and
Tier 2 SCF Commercial License.

Commercial license restrictions by business type:

Tier 1 and Tier 2 SCF Commercial Licenses are restricted to GRC, or similar technology, platforms.
Tier 2 SCF Commercial Licenses are prohibited from selling SCF-based content (e.g., policies, standards, procedures, metrics, etc.) in any form of online storefront or marketplace, where the SCF-based content is restricted for sale within the GRC, or similar technology, platform.

Tier 1 SCF Commercial License

Annual Fee: $25,000 (USD) [note - GRC startups may be eligible for a 50% discount for the first year's fees. Contact the SCF Council for details]

The Tier 1 SCF Commercial License enables GRC platforms to leverage the SCF to:

Reproduce and Share the Licensed Material, in whole or in part; and
Produce, reproduce and share Adapted Material that is restricted to the following:
Custom-developed guidance on how to implement SCF controls (e.g., static answers, chatbot interaction, etc.) that includes:
Reformatting SCF controls or control questions into a questionnaire format for readability purposes (e.g., Third-Party Risk Management (TPRM) survey);
People, Processes, Technologies, Data & Facilities (PPTDF) applicability;
Risk calculators; and/or
Control deficiency guidance (e.g., possible compensating controls); and
Modify the following, existing SCF content:
Maturity-level criteria;
Possible solutions and considerations to implement SCF controls;
Risk and/or threat catalogs tied to SCF controls; and/or
Conformity Validation Criteria (CVC).

Tier 2 SCF Commercial License

Annual Fee: $200,000 (USD) + 20% of net sales associated with SCF-based derivative content.

‍The Tier 2 SCF Commercial License enables mature GRC platforms to leverage the SCF to:

Reproduce and Share the Licensed Material, in whole or in part; and
Produce, reproduce and share Adapted Material that is restricted to the following:
Custom-developed guidance on how to implement SCF controls (e.g., static answers, chatbot interaction, etc.) that includes:
Reformatting SCF controls or control questions into a questionnaire format for readability purposes (e.g., TPRM survey);
PPTDF applicability;
Risk calculators; and/or
Control deficiency guidance (e.g., possible compensating controls); and
Modify the following, existing SCF content:
Maturity-level criteria;
Possible solutions and considerations to implement SCF controls;
Risk and/or threat catalogs tied to SCF controls; and/or
CVC; and
SCF-based:
Policies;
Control objectives;
Standards;
Guidelines;
Procedures; and/or
Metrics / analytics.

Prohibitions

SCF Licensing Prohibitions Overview

Prohibitions for Standard and Commercial Licenses

While an end user of the SCF is permitted modify content for their own internal use, the following prohibitions apply to both standard or commercial SCF licensees:

Creating and/or changing core SCF content, including:
SCF Domain Name;
SCF Domain Acronym;
SCF Control Number;
SCF Control Name;
SCF Control Description;
SCF Assessment Objectives (AOs);
SCF Control Weighting values;
Evidence Request List (ERL) items; and
Mappings to Laws, Regulations and Frameworks (LRF); and
New controls cannot be added to the SCF without the express, written authorization by the SCF Council.
New controls can be suggested for addition to the SCF control catalog; and
The SCF releases quarterly updates and it welcomes customer feedback for updates / modifications to mappings.

SCF Commercial License Overview

Join 25,000+ GRC Professionals