The Secure, Compliant & Resilient Risk Management Model (SCR-RMM) is a free, structured methodology to identify, assess, report and mitigate risk. Jointly developed by ComplianceForge and the SCF Council, the SCR-RMM breaks risk management down into seventeen (17) distinctive steps, from establishing risk management principles through implementing and documenting risk treatment.
The concept of creating the SCR-RMM was to establish an efficient methodology to identify, assess, report and mitigate risk across the entire organization. The project was a collaboration between ComplianceForge and the SCF, approached from the perspective of asking: "How should I manage risk?"
The SCR-RMM is designed to be an integral tool of an organization's ability to demonstrate evidence of due diligence and due care. This not only benefits your organization by having solid risk management practices, but it can also serve as a way to reduce risk for those who have to initiate the hard discussions on risk management topics.
The most important concept to understand is that cybersecurity and IT departments generally do not "own" technology-related risks. That "risk ownership" primarily resides with Line of Business (LOB) management. The SCR-RMM exists to help cybersecurity and data privacy functions create a repeatable methodology that guides the decision to a risk treatment option: reduce, avoid, transfer, or accept.
"Don't Shoot The Messenger" Protections
Quality risk management documentation can prove that reasonable steps were taken to identify, assess, report and mitigate risk. This provides evidence of due diligence and due care that firmly puts responsibility back on the management that "owns" the risk.
The SCR-RMM integrates risk management with business planning at three levels: strategic, operational, and tactical. Each level has distinct risk management considerations and decision-making authority. If you worry about having to preface risk management discussions with, “Please don't shoot the messenger!” then the SCR-RMM can be an additional layer of protection for your professional reputation. Where the SCR-RMM benefits security, technology and privacy personnel is the potential “get out of jail” documentation that quality risk assessments and risk management practices can provide. Just like with compliance documentation, if risk management discussions are not documented then risk management practices do not exist.
Instead of executive leadership hanging blame on the CIO or CISO, quality risk management documentation can prove that reasonable steps were taken to identify, assess, report and mitigate risk. This type of documentation can provide evidence of due diligence and due care on the part of the CIO/CISO/CRO, which firmly puts the responsibility back on the management of the team/department/line of business that “owns” the risk.
Based on the applicable statutory, regulatory and contractual obligations that impact the scope of a risk assessment, an organization is expected to have an applicable set of cybersecurity and data privacy controls to cover those needs.
Risk appetite is defined at the corporate level. It affects strategic actions and decisions that define the types and amount of risk an organization is willing to accept. Strategic risk management considers organizational objectives, mergers & acquisitions, competitive advantage, and the overall cybersecurity program.
Risk tolerance is put into practice at the Line of Business (LOB) level. It affects operational actions, decisions and resource allocation. Operational risk management considers LOB objectives, capability maturity targets, resource prioritization, and the level of risk the entity is willing to assume.
Risk thresholds affect actions and decisions at the department and team levels. They influence processes, technologies, staffing levels, and the supply chain. Defined risk thresholds provide concrete criteria to assess operational risks that exist in the course of conducting business.
The SCR-RMM breaks risk management down into 17 distinctive steps, providing coverage from start to finish. This spans from establishing risk management principles through implementing and documenting risk treatment.
The SCF Threat Catalog answers the question: "What natural and man-made threats affect control execution?" If the threat materializes, will the control function as expected? A threat is a person or thing likely to cause damage or danger. A risk exists due to the absence of or a deficiency with a control. The SCR-RMM catalogs both to provide complete risk coverage.
The SCF Risk Catalog answers: "What are the risks associated with a control deficiency?" If the control fails, what risk(s) is the organization exposed to? Risks are organized into eight groupings.
The goal of the SCR-RMM is to categorize risk assessment results according to one of four risk determinations, normalizing the terminology associated with the level of conformity an organization achieves to its applicable cybersecurity and data protection controls.
The organization demonstrates full conformity to all applicable controls with no identified deficiencies.
The organization demonstrates conformity with minor deficiencies that do not materially impact the overall risk posture.
One or more identified control deficiencies that, individually or in combination, are less severe than a material weakness but significant enough to warrant attention.
A deficiency, or combination of deficiencies, where reasonable threats will not be prevented or detected in a timely manner, directly affecting assurance that the organization can adhere to its stated risk tolerance.
The SCR-RMM integrates with the full SCF assessment ecosystem. Each SCF tool plays a specific role in the risk management process.
Step 7 of the SCR-RMM uses the SCR-CMM to define capability maturity targets. CMM scores directly inform risk exposure calculations in Step 12. The maturity level determines how effectively controls mitigate identified risks.
Step 6 establishes the controls catalog from the SCF's 1,400+ controls. Every risk in the Risk Catalog and every threat in the Threat Catalog maps directly to SCF controls, providing complete linkage from risk to treatment.
The CDPAS provides the standards for third-party assessments that feed into the SCR-RMM conformity assessment (Step 10). CDPAS-governed assessments produce the findings that the RMM uses for risk determination.
The ERL defines what evidence must be collected during the conformity assessment (Step 10) and control assessment (Step 11). Standardized evidence expectations enable consistent risk determination.
The USG helps establish the organizational and environmental context for assessing risks (Step 9) by defining the People, Processes, Technologies, Data, and Facilities (PPTDF) that comprise the assessment boundary.
The Report on Conformity (ROC) produced in Step 14 of the SCR-RMM directly supports the SCF Conformity Assessment Program. Organizations pursuing SCF-CAP certification use the RMM risk determinations as part of their conformity evidence.
The SCR-RMM is designed to operate within a continuous PDCA improvement cycle, treating risk management as an ongoing organizational capability integrated into business-as-usual activities.
Identify risk management principles (Step 1). Document critical dependencies (Step 2). Formalize risk management practices (Step 3). Establish risk, threat, and controls catalogs (Steps 4–6). Define CMM targets and assessment rigor (Steps 7–8).
Establish context (Step 9). Conduct conformity assessment (Step 10). Apply assessment methods and document findings (Step 11). Determine risk exposure by calculating inherent and residual risk (Step 12).
Prioritize and document deficiencies (Step 13). Produce the Report on Conformity categorizing results as Strictly Conforms, Conforms, Significant Deficiency, or Material Weakness (Step 14).
Identify the appropriate management audience (Step 15). Management determines risk treatment: reduce, avoid, transfer, or accept (Step 16). Implement and document risk treatment (Step 17).
%20(white).png)
.png)