SCRMS: Secure, Compliant & Resilient Management System

Overview

What Is The SCRMS?

The Secure, Compliant & Resilient Management System (SCRMS) is a framework and technology-agnostic approach to designing, implementing and maintaining secure, compliant and resilient capabilities across an entity's People, Processes, Technology, Data, Facilities and Artificial Intelligence (PPTDF-AI).

The SCRMS has two goals: to provide the structure to be secure, compliant and resilient, and to generate defensible evidence of due diligence and due care. A program is defensible when evidence proves that risks were identified, controls were recommended and leadership made informed decisions.

The SCRMS expands upon and modernizes the traditional Information Security Management System (ISMS) model. Instead of siloed management systems, one living control set adjusts to every law, regulation and framework the entity must address.

SCRMS product card showing the Secure, Compliant & Resilient Management System, a framework-agnostic approach to design, implement, and maintain secure compliant and resilient capabilities

Built To Withstand Scrutiny

SCRMS capabilities are meant to be built and governed in a reasonable manner that would withstand scrutiny from an external auditor, regulator or prosecuting attorney.

Download the SCRMS (PDF)

Audience

Who Is The SCRMS For?

The SCRMS is written for security and compliance decision makers, and it assigns responsibilities beyond the security team. It is meant to be tailored to each entity's size, resources and risk circumstances.

CISOs And GRC Directors

The Chief Information Security Officer (CISO) and the Governance, Risk & Compliance (GRC) Director are the primary audience, as the decision-makers for secure, compliant and resilient practices.

Executive Leadership

Executive leadership defines materiality, approves the multi-year plan and assigns accountability across departments.

Control Owners And Operators

Each control has an owner, and its procedures belong to the control owner and operator, not to the security team.

Structure

How Is The SCRMS Organized?

Sections 1 to 10 set out the model, including its nine principles and how to determine the control set. Section 11 lists the due diligence requirements by Secure Controls Framework (SCF) domain, Section 12 covers due care, and Section 13 covers demonstrating assurance to stakeholders.

Part	Sections	What it covers	How to use it
Foundations	1 to 4	Purpose, audience, normative references, terminology, and what "secure," "compliant" and "resilient" mean	Read once
Scope of Secure, Compliant & Resilient Activities	5	What is in scope, and the PPTDF-AI test for whether a control applies	Read once, then return to it when scoping
SCRMS Principles	6	The nine principles that make up the operating model, arranged as a Plan, Do, Check, Act cycle	Read carefully. This is the core.
Control Set Determination	7	How the control set is built: MCR + DSR = MSR, the Living Control Set and material controls	Read carefully. This is where the work starts.
Due diligence, due care, business planning and risk	8 to 10	The two foundational constructs, integration with business planning, the nested approach to risk, and materiality	Read once
Due Diligence Activities	11	Requirements by SCF domain, each with its SCF control(s) and the evidence needed to prove it	Reference. Look up by domain.
Due Care Activities	12	Demonstrating conformity, non-compliance oversight, measures of performance, incident response testing, continual improvement and quality management	Reference
Demonstrating Assurance to Stakeholders	13	How the program is validated by a third party	Read when ready for an assessment
Annexes 1 to 4	Annexes	The SCF controls the SCRMS uses, adequate security, defensible evidence, and planning for resistance	Read Annex 1 before tailoring. Read Annexes 3 and 4 once.

Implementation

How Do Organizations Use The SCRMS?

The SCRMS's nine principles form a Plan, Do, Check, Act cycle, and implementation follows them in five phases.

Establish Context

The organization records its structure, mission and strategy, risk appetite, tolerance and thresholds, and the laws, regulations and contracts that apply to it. Much of it comes from legal, procurement, Human Resources (HR) and other teams outside Information Technology (IT) and security.

Principle 1

Build The Control Set

Controls required by laws, regulations and contracts are combined with controls the organization chooses for its own reasons into one Living Control Set, reviewed at least once a year. Each control is checked for applicability against PPTDF-AI, and every applicability decision is documented.

Principle 2

Sections 5 and 7

Weight Controls And Set Maturity

Material controls, where no reasonable compensating control can offset a failure, receive higher maturity targets, more oversight and priority in funding and remediation. Every control gets a maturity target that at least meets legal and contractual obligations.

Principle 3

Sections 7.2.2 and 10.2

Document And Implement Controls

Policies, standards and procedures document each control, and each control is assigned to an owner. Section 11 gives, by SCF domain, each requirement, its SCF controls and the evidence that proves them.

Principles 4 and 5

Section 11

Govern Over Time

Building the program is due diligence, and governing it is due care. The organization prioritizes capabilities by risk in a multi-year plan, uses metrics to show whether it is secure, treats risk within its appetite and keeps the Living Control Set current.

Principles 6 to 9

Section 12

The full requirements for each SCF domain are in the SCRMS. The companion SCRMS Prioritized Implementation Guide (SCRMS-PIG) orders implementation into 30 steps: 26 for building the program and 4 for governing it.

Older Control Numbers

The SCRMS cites control numbers from before the SCF 2026.3 reorganization, which renumbered most controls. In the SCF workbook, these numbers are found in the Legacy SCF # column of the main tab, not the SCF # column. Where controls were merged, one cell can hold more than one legacy number.

Download the SCRMS (PDF)Explore the SCRMS-PIG

Control Set

From Compliance Obligations To A Living Control Set

The Living Control Set (LCS) is the entity's own definition of reasonable security, compliance and resilience at a point in time, not a static catalog or a generic framework mapping.

✓

Minimum Compliance Requirements (MCR): "must have" controls sourced directly from applicable laws, regulations and contracts.

✓

Discretionary Security Requirements (DSR): "nice to have" controls from sources such as Board guidance, internal audit findings and prior incidents. Once justified by risk, they are as mandatory as MCR.

Venn diagram showing the relationship between Minimum Compliance Requirements (MCR) and Discretionary Security Requirements (DSR) with the overlap representing compliant and secure controls

Every change to the LCS must be documented, justified and traceable to a trigger, such as new obligations, threats, incidents or business changes.

Foundations

Due Diligence And Due Care

Due Diligence: Building The Capability

Due diligence asks whether the entity has taken reasonable steps to build and operate secure, compliant and resilient capabilities, backed by objective evidence that controls operate as intended.

Due Care: Governing The Capability

Due care asks whether leadership is actively governing and adapting those capabilities as risks and conditions change. It protects directors and officers by demonstrating informed oversight and documented risk decisions.

Defensible Evidence Is The Byproduct

Defensible evidence is documented evidence so well collected and preserved that it is admissible in court and able to withstand legal challenge. It is the natural byproduct of secure, compliant and resilient practices.

Materiality

A Nested Approach To Risk Management

Third-Party Risk Management (TPRM) sits under security, compliance and resilience risk management, which sits under Enterprise Risk Management (ERM). All three rely on entity-specific definitions of risk appetite, tolerance and threshold.

✓

Material Control: a control that cannot have compensating controls, and whose absence or failure could have a material impact.

✓

Material Risk: a scenario of danger, harm or loss with a material impact, recorded in the risk catalog.

✓

Material Threat: a vector of damage or danger with a material impact, recorded in the threat catalog.

✓

Material Incident: an occurrence that does or could jeopardize a system or its data, or violate policy, with a material impact.

Materiality Is An Executive Determination

Defining materiality is "an executive leadership determination, not a cybersecurity determination," based primarily on a financial threshold. As a benchmark, something is generally material at 5% of earnings before tax, 0.5% of total assets, 1% of total equity or 0.5% of total revenue.

Assurance

Proving Conformity To Stakeholders

The SCRMS was designed to integrate with the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP), an entity-level conformity assessment. Because the SCF is a metaframework, one assessment can span multiple laws, regulations and frameworks.

Principles

Nine Principles That Define The System

Of the nine principles in Section 6, Principle 2 establishes the LCS and Principle 9 updates it as processes evolve.

#	Principle	What It Requires
1	Establish Context	Build a hierarchical vision, mission and strategy that supports the entity's broader strategic objectives, identifying applicable laws, regulations, contractual obligations and internal directives, as well as applicable risks and threats.
2	Identify Applicable Controls	Establish a tailored control set that combines Minimum Compliance Requirements (MCR) and Discretionary Security Requirements (DSR). This blend of "must have" and "nice to have" requirements is where the Living Control Set (LCS) is established.
3	Define Maturity Expectations	Define entity-specific "what right looks like" expectations for implementing and operating controls. Maturity targets support multi-year business planning, budgeting and assessment criteria.
4	Publish Governance Documentation	Formalize requirements in documented policies, standards and procedures. Without documentation, governance practices are both unenforceable and indefensible.
5	Assign Stakeholder Accountability	Assign controls to control owners, who assign execution to control operators at the individual contributor level. Stakeholders develop Standardized Operating Procedures (SOP) so those controls can be executed, and documented execution provides evidence of due care.
6	Prioritize Capabilities According To Risk	Prioritize capabilities based on applicable risks and threats. Not all risks and threats are equal, so a risk-based prioritization must occur.
7	Maintain Situational Awareness	Go beyond point-in-time metrics to longer-term trend analysis, tied in with current audits, control deficiencies, risk, threat and vulnerability information.
8	Manage Risk	Operate proactive risk management across the life cycle of technology assets, applications, services and data, addressing confidentiality, integrity, availability and safety, including data privacy, Artificial Intelligence (AI), embedded technology and Supply Chain Risk Management (SCRM) considerations.
9	Evolve Processes	Adopt a Plan, Do, Check & Act (PDCA) approach so capabilities adapt to changes in the compliance landscape, technology changes and budget or resourcing constraints.

Domains

Due Diligence Requirements By Domain

Section 11 states what the entity must do in each SCF domain, then lists numbered requirements with their SCF controls and evidence.

Section	Domain	What The Entity Must Do
11.1	Secure, Compliant & Resilient Program (SCRP)	Specify the development of its security, compliance and resilience program, including criteria to measure success, to ensure ongoing leadership engagement and risk management.
11.2	Artificial Intelligence & Autonomous Technologies	Ensure AI and autonomous technologies are designed to be reliable, safe, fair, secure, resilient, transparent, explainable and data privacy-enhanced, with AI-related risks governed to minimize emergent properties or unintended consequences.
11.3	Asset Management	Manage technology assets throughout the lifecycle from procurement through disposal, ensuring only authorized devices access the entity's network.
11.4	Business Continuity & Disaster Recovery	Establish processes to recover from adverse situations with minimal impact to operations, including the capability for e-discovery.
11.5	Capacity & Performance Planning	Prevent avoidable business interruptions caused by capacity and performance limitations by proactively planning for growth and forecasting.
11.6	Change Management	Proactively manage change, including the assessment, authorization and monitoring of technical changes, so production systems uptime is not impacted.
11.7	Cloud Security	Govern private and public cloud environments (IaaS, PaaS and SaaS) to manage third-party and architectural risk, and to ensure data portability.
11.8	Compliance	Ensure controls are in place to adhere to applicable statutory, regulatory and contractual obligations, as well as internal company standards.
11.9	Configuration Management	Establish and maintain the integrity of systems so that security features cannot be inadvertently or deliberately omitted or rendered inoperable.
11.10	Continuous Monitoring	Maintain ongoing situational awareness across the enterprise through centralized collection and review of security-related event logs.
11.11	Cryptographic Protections	Protect the confidentiality and integrity of data by implementing appropriate cryptographic technologies across systems, applications, services and data.
11.12	Data Classification & Handling	Properly classify technology assets, both electronic and physical, and implement measures to protect data from unauthorized disclosure or modification.
11.13	Embedded Technology	Specify the development, proactive management and ongoing review of embedded technology security, including hardening the stack for Internet of Things (IoT) and Operational Technology (OT) devices.
11.14	Endpoint Security	Ensure endpoint devices are appropriately protected from security threats to the device and its data.
11.15	Human Resources Security	Create a security, compliance and resilience-minded workforce and an environment that is conducive to innovation.
11.16	Identification & Authentication	Implement the concept of least privilege by limiting access to the entity's systems and data to authorized users only.
11.17	Incident Response	Maintain a viable and tested capability to respond to cybersecurity or data privacy-related incidents in a timely manner.
11.18	Information Assurance	Ensure the adequacy of security, compliance and resilience controls in development, testing and production environments.
11.19	Maintenance	Ensure technology assets, applications and services are properly maintained, with additional scrutiny on end-of-life or unsupported assets.
11.20	Mobile Device Management	Govern risks associated with mobile devices regardless of ownership, centrally managing device access and data storage wherever possible.
11.21	Network Security	Architect controls to protect the confidentiality, integrity, availability and safety of network infrastructure and to provide situational awareness of network activity.
11.22	Physical & Environmental Security	Minimize physical access to the entity's systems and data, and ensure environmental controls are in place and continuously monitored.
11.23	Data Privacy	Align data privacy engineering decisions with the entity's data privacy strategy and industry-recognized leading practices to secure Personal Data (PD) through data privacy by design and by default.
11.24	Project & Resource Management	Ensure security-related projects have both resource and project or program management support to enable successful execution.
11.25	Risk Management	Ensure the business units that own the assets and processes involved are aware of and understand all applicable security, compliance and resilience risks, since those business units ultimately own the risk.
11.26	Secure Engineering & Architecture	Align cybersecurity engineering and architecture decisions with the entity's overall technology architectural strategy and industry-recognized leading practices.
11.27	Security Operations	Ensure appropriate resources and a management structure exist to deliver cybersecurity, physical security and data privacy operations.
11.28	Security Awareness & Training	Develop a security, compliance and resilience-minded workforce through continuous education activities and practical exercises.
11.29	Technology Development & Acquisition	Build security, compliance and resilience principles, including least privilege and least functionality, into products and solutions, whether developed internally or acquired.
11.30	Third-Party Management	Minimize third-party risk and enable measures to sustain operations should a third party become compromised, untrustworthy or defunct.
11.31	Threat Management	Proactively identify and manage technology-related threats to the security, compliance and resilience of systems, data and business processes.
11.32	Vulnerability & Patch Management	Proactively manage technical vulnerability risk, ensuring good patch and change management practices are utilized.
11.33	Web Security	Address risks from Internet-accessible technologies by hardening devices, monitoring system file integrity, and enabling auditing and monitoring for malicious activity.