.png)
A Practical Starting Point for Smaller Organizations
Smaller organizations face the same threats as large enterprises, usually with far fewer people and less budget. SCF CORE Fundamentals narrows the SCF down to the controls that give these organizations the most protection for the effort involved.
The SCF Council created the CORE initiative to close that gap. The full SCF catalog provides comprehensive coverage, but small and mid-sized businesses need a focused, actionable starting point they can tailor to their own needs. SCF CORE Fundamentals provides that starting point with controls derived from the Common Controls Framework (CCF) and calibrated to the realities of a smaller organization.
Volunteer-Driven & Creative Commons Licensed
SCF CORE Fundamentals is developed by volunteer cybersecurity practitioners and released under a Creative Commons license. There is no cost to access or implement it.
Built With Texas SB 2610 In Mind
Texas SB 2610 prevents the recovery of exemplary damages in data breach lawsuits against Texas businesses with fewer than 250 employees that maintain a cybersecurity program conforming to a recognized framework. The Secure Controls Framework is one of the frameworks the law names for alignment. SCF CORE Fundamentals gives these businesses a defined control set to implement, document and show at the time of a breach.
The Safeguards That Matter Most
SCF CORE Fundamentals spans the SCF domains most critical to a small or medium business security program. Examples include:
Governance
Documented security responsibilities, published policies and defined roles for personnel
Assets & Data
Inventories of technology assets and sensitive data, plus network and data flow diagrams
Identity & Access
Account management, least privilege, privileged account management and phishing-resistant multi-factor authentication
Data Protection
Encryption of data in transit and at rest, key management and secure media disposal
Secure Configuration
Secure baseline configurations and change control
Network & Endpoint
Boundary protection, DNS filtering, phishing and spam protection, secure remote access and antimalware
Monitoring
Event log monitoring and detection of anomalous behavior
Vulnerability Management
Vulnerability scanning, patching and a defined remediation process
Resilience
Data backups with redundant copies, restore testing and tested continuity and recovery plans
Incident Response
An incident response plan, incident handling and stakeholder reporting
People
Personnel screening, onboarding and offboarding, and security awareness training
Third Parties
Third-party inventories, contract requirements and supply chain risk management
Risk
Risk assessments, a risk register and documented risk treatment decisions
AI
Basic governance over the use of AI and autonomous technologies
The complete control set is in the SCF download and is updated with each SCF release.
Minimum Compliance & Discretionary Security Requirements
Each control can be classified by why it is needed. This helps a small organization separate what it must do from what it chooses to do based on risk.
MCR
Minimum Compliance Requirements
Controls required by laws, regulations or contracts. These are non-negotiable and form the baseline the organization must meet.
DSR
Discretionary Security Requirements
Controls the organization selects based on its own risk assessment. These go beyond the minimum to address the threats and business needs specific to the organization.
A Consistent Baseline for Assessing Vendors
Organizations can use SCF CORE Fundamentals as a common baseline for third-party risk management (TPRM). Asking smaller vendors to answer against the same focused control set makes their responses easier to compare and keeps questionnaires proportionate to the vendor's size.
TPRM Components
- A control questionnaire
- Control weighting based on criticality
- Evidence Request List (ERL) references for each control
- Assessment Observations
- A risk and threat crosswalk
- A scoring methodology
Third-Party Assessable Through SCR CAP
SCF CORE Fundamentals can be independently assessed through the SCR Conformity Assessment Program (SCR CAP). A third-party assessment gives a small business documented evidence of its cybersecurity program, which can help demonstrate conformity with a recognized framework if a breach occurs.
The SCR CAP Assessment Guide Covers
- Scoping the assessment boundary
- Control criteria for each control
- Evidence aligned with the Evidence Request List
- Assessment Observation templates
- Scoring
- Tracking of non-conformities
- Conformity statements
%20(white).png)