.png)
What Is The SCRMS-PIG?
The Secure, Compliant & Resilient Management System (SCRMS) Prioritized Implementation Guide (SCRMS-PIG) is the operational companion to the SCRMS. The SCRMS defines what it means to be secure, compliant and resilient, and the SCRMS-PIG provides a prioritized, dependency-aware roadmap to implement and govern those capabilities.
The guide breaks implementation into 30 major steps that can be turned into a project plan: 26 due diligence steps that build the program and 4 due care steps that govern it. The steps follow dependencies but are not purely linear, so implementers adjust the approach to fit the organization.
The roadmap is designed to avoid rework from building capabilities out of dependency order, align funding and resources with business risk and provide assurance to stakeholders through audit-ready evidence.
Built For Accountability, Not Checklists
The SCRMS is built to model material risk and material control failure. It was purpose-built for real-world accountability, not checklist compliance, so that capabilities are built and governed in a reasonable manner that would withstand scrutiny from an external auditor, a regulator or a prosecuting attorney.
Who Is The SCRMS-PIG For?
The SCRMS-PIG suits organizations large enough to have people in cybersecurity roles, whether they are new to the SCRMS or double checking their approach.
Management: Execution
Management designs, implements and operates the program's capabilities and produces evidence that controls exist and operate as intended. Steps 1 to 26 cover this work, carried out by implementers such as cybersecurity practitioners.
Executives & The Board: Oversight
Executives and the Board are responsible for oversight, risk acceptance and strategic direction. In Steps 27 to 30 they challenge assumptions, confirm priorities align with business risk and ensure unresolved risks are consciously accepted.
How Is The SCRMS-PIG Organized?
The front half of the SCRMS-PIG explains the logic behind the order, including due diligence, due care and the Critical Resource Enablement Path (CREP). The back half holds the 30 steps, Appendix A with the Secure Controls Framework (SCF) controls for each step and Appendix B with the evidence that supports those controls.
How Do Organizations Use The SCRMS-PIG?
The guide's 30 steps fall into six phases.
Establish Context
The organization defines its mission, establishes the program and identifies the laws, regulations, contracts and security expectations that apply. From these it builds a preliminary Living Control Set and defines the program's scope and target maturity.
Govern And Manage Risk
Central policies and standards, exception management and control owners are put in place. Risk management follows, subordinate to enterprise risk management and supported by a central risk register or Plan of Action & Milestones.
Know The Environment And Resource The Program
Inventories of assets, data, service providers and data flows give the situational awareness needed to justify funding. The Chief Information Security Officer, with a Program Management Office or similar function, then builds a business plan, budget and prioritized roadmap.
Set Engineering And Supply Chain Criteria
Secure practices are defined across the system development lifecycle, including Risk Treatment Plans. Supply chain security follows and reaches beyond the cybersecurity team to procurement, data privacy and contracts management.
Build Operational Capabilities
Each step builds one capability, from cybersecurity operations through incident response, identity and access management and threat intelligence. Up to attack surface management, dependencies set the order, such as secure baseline configurations before identity and access management.
Govern With Due Care
Executives and the Board oversee governance, manage risk, test capabilities and evolve the program. Each step lists the evidence the Board should expect, questions to ask and red flags.
The full steps, sub-steps, controls and evidence are in the SCRMS-PIG.
Older Control Numbers
The SCRMS-PIG cites control and evidence numbers from before the SCF 2026.3 reorganization, which renumbered most controls. In the SCF workbook, a cited control is found in the Legacy SCF # column of the main tab, not the SCF # column, and its current evidence is in the Evidence Request List (ERL) # column on that row. Many of the old numbers now belong to a different control.
Foundations Come First
Security, compliance and resilience capability failures are rarely caused by missing controls. They come from misaligned sequencing, constrained resources and unmanaged dependencies.
The Critical Resource Enablement Path (CREP) is the sequence in which constrained resources must be enabled to prevent bottlenecks, so foundational capabilities exist before the capabilities that depend on them. The CREP can change the order under budget constraints, supply chain issues and staffing shortages.
The CREP is how the SCRMS applies the Theory of Constraints: managing the single most limiting constraint, not maximizing each control on its own. It shows that resource decisions were made rationally, based on identified constraints and documented dependencies.
What A Constraint Looks Like
An entity deploys a Security Information and Event Management (SIEM) tool but lacks trained analysts and defined escalation procedures, so incident response stays constrained by staffing and process maturity. Another implements Secure Baseline Configurations (SBC), but an immature change management process produces frequent unauthorized changes that negate the benefit of hardened baselines.
Due Diligence Builds It. Due Care Governs It.
Entities rarely fail because they lack controls. Failures often occur because leadership cannot prove reasonable prioritization or show evidence of oversight after the fact. The SCRMS addresses both by producing defensible evidence of due diligence and due care.
Due Diligence (Steps 1 to 26): Asks whether the entity has taken reasonable steps to build and operate secure, compliant and resilient capabilities. These steps produce a significant amount of defensible evidence.
Due Care (Steps 27 to 30): Asks whether leadership is actively governing and adapting capabilities as risks and conditions change.
By adopting the SCRMS and the SCRMS-PIG, leadership gains clear visibility into risk posture, documented oversight and accountability, evidence of reasonable decision-making, confidence in legally defensible evidence of conformity and a shared language between business, risk, legal and technical stakeholders.
The Claim Leadership Can Credibly Make
"We understand our risks, we prioritize them rationally and we continuously adapt our capabilities as conditions change."
Five Lenses For Control Applicability
Appendix A marks which of five components, People, Processes, Technologies, Data and Facilities (PPTDF), each control directly applies to. Constraints most commonly appear as deficiencies in one of these components.
People: Humans, such as training, background checks and non-disclosure agreements.
Processes: Administrative work, such as processes, procedures and administrative documentation.
Technologies: Systems, applications and services, such as secure baseline configurations and patching.
Data: Data protection, such as encrypting sensitive and regulated data and applying metatags.
Facilities: Infrastructure assets, such as physical access, Heating, Ventilation and Air Conditioning (HVAC) systems and visitor control.
Proving Conformity To Stakeholders
Appendix B lists the evidence artifacts the steps can produce, drawn from the SCF's Evidence Request List (ERL). Audit readiness follows as a byproduct of defensible governance.
The SCRMS was designed to integrate with the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP), the SCF's entity-level conformity assessment. It uses tailored controls that address the statutory, regulatory and contractual obligations an Organization Seeking Assessment (OSA) must comply with, across multiple laws, regulations and frameworks.
%20(white).png)