.png)
What Is The USG?
The Unified Scoping Guide (USG) is the Secure Controls Framework (SCF) method for defining the scope of sensitive and regulated data where it is processed, stored or transmitted. It sorts every system, application, service and third party into zones by how each relates to that data, before deciding which controls apply.
The USG is data-centric: assets can be replaced, but the data on them cannot. Scope follows four factors: data, connectivity, security functionality and lifecycle influence. The same zone-based model applies to all seventeen data types the guide lists, from cardholder data to AI system data.
The people, processes, technologies, data, facilities and artificial intelligence (PPTDF-AI) that handle this data make up the Sensitive Data Environment. The model builds on the Payment Card Industry Data Security Standard (PCI DSS) Scoping Model and Approach from PCI Resources, extended to other data types.
Scoping ≠ Applicability
Scoping decides what is inside the assessment boundary; applicability then decides which controls apply to each thing inside it. A network firewall in scope needs controls such as multi-factor authentication and patch management, but it cannot take end user training. The USG does not set which statutory, regulatory or contractual controls each category requires; each organization and its assessor determine that.
Who Is The USG For?
The USG is for any organization that must define the boundary around its sensitive or regulated data, and for the assessors who validate it.
Organizations Defining Scope
The zone model shows which assets and third parties belong in scope, so that poor scoping does not pull every system into scope.
Assessors
The USG is the official scoping guidance for the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP) and gives assessors a method for validating assessment boundaries.
How Is The USG Organized?
The USG first explains the intent of scoping and control applicability, then sets out its core: ten zones, overlays, an In-Scope Matrix and an Asset Scoping Decision Tree. Data type definitions, zero trust guidance and the appendices serve as reference.
Additional Guidance
The USG also covers segmentation, zero trust and data spills. Its appendices cover data flow diagrams, Virtual Desktop Infrastructure (VDI), peripheral devices, embedded technologies, "must have" versus "nice to have" controls and documentation.
How Do Organizations Use The USG?
Scoping with the USG follows six phases: boundary first, then zones, then applicability.
Identify The Data
The organization lists the sensitive and regulated data types it must protect, confirms each definition in the guide and records how long each must stay confidential.
Draw And Document The Boundary
The assessment boundary covers the Sensitive Data Environment (SDE) and everything that influences its security, documented with inventories, network diagrams and data flow diagrams. Segmentation keeps the boundary small; on a flat network, the entire network would be expected to be in scope.
Place Every Asset In A Zone
Each asset is placed in one of the ten zones, with the Asset Scoping Decision Tree as a guide. An asset is out of scope (Zone 5) only if it passes all five of the guide's out-of-scope tests.
Account For Third Parties
External service providers, subcontractors, cloud service providers and technology dependencies (Zones 7 to 10) are reviewed for how they can influence the SDE. The result is checked against the In-Scope Matrix and the System-to-System Communications matrix.
Decide Which Controls Apply
Only then does the organization decide which administrative, physical and technical controls apply to the people, processes, technologies, data, facilities and AI inside the boundary. Each decision is documented with its rationale.
Keep Scope Current
Scoping is repeated after events such as mergers, cloud migrations, new data types, segmentation changes and data spills. Without a trigger, scope is reviewed at least annually.
The full method, zone definitions and out-of-scope tests are in the USG.
Ten Zones for Sensitive Data Compliance
The USG sorts system components into ten zones by how each interacts with sensitive and regulated data, and each zone carries different risks. Zones 1 to 4 are in scope, with Zone 4 split into 4A (directly connected) and 4B (indirectly connected). Zone 5 is out of scope, Zone 6 is the enterprise-wide security program, and scope for Zones 7 to 10 must be determined case by case.
The rule behind the connected zones: anything that can impact the security of that data is in scope.
Macro Scoping & Micro Scoping
Macro scoping sets the assessment boundary: the entire organization, a specific contract, project or initiative, a business unit, or a country or geographic region. Micro scoping then decides which controls apply to the PPTDF-AI inside that boundary.
Controls fall into three functions:
Administrative: Non-technical mechanisms that guide employee actions, such as policies, standards, metrics, program governance and risk management.
Physical: Controls that restrict physical access, such as badges, visitor control, video surveillance, locks and security guards.
Technical: Technical measures that protect the confidentiality, integrity, availability and safety of technology assets and data, such as antimalware, firewalls, log management and encryption.
The USG Works With the SCF Assessment Ecosystem
The USG refers to other free SCF content.
CDPAS Assessment Standards
Standard 4.2 of the Cybersecurity & Data Protection Assessment Standards (CDPAS) points assessors to the USG for validating assessment boundaries.
Evidence Request List (ERL)
An ERL is a finite list of supporting evidence, provided by the assessor before an assessment starts so the organization has time to gather it.
SCF Control Catalog
The Secure Controls Framework (SCF) is a community-driven metaframework of 1,500+ controls spanning 200+ laws, regulations and frameworks.
SCR CAP Conformity Assessment
The SCR CAP relies on the USG, its official scoping guidance, to designate controls as in or out of scope.
SCRMS
The USG points to the Secure, Compliant & Resilient Management System (SCRMS) for identifying "must have" versus "nice to have" controls.
Sensitive & Regulated Data Types
The USG groups sensitive and regulated data as "sensitive/regulated data" and applies one model to every type it lists. Sensitivity still varies within a type: not all personal data is sensitive, and not all intellectual property is equally valuable.
%20(white).png)