.png)
Understand Cybersecurity Risk Before The Deal Closes
When one organization acquires another, it also takes on that organization's security weaknesses, data obligations and technical debt. Cybersecurity due diligence is often handled with custom questionnaires that differ from deal to deal, which makes findings hard to compare and easy to dispute.
SCF CORE MA&D gives both sides a defined set of controls to assess against. The buyer gets a clearer view of the risk it is inheriting and the cost to address it. The target gets a known standard to prepare for, instead of a moving list of requests.
SCF CORE MA&D is part of the CORE initiative, which the SCF Council created to turn the comprehensive SCF catalog into focused, actionable baselines. Its controls are derived from the Common Controls Framework (CCF) and calibrated to the questions a transaction raises, so buyers and targets start from the same defined scope instead of building a custom control set for each deal.
Inherited Risk
Identify weaknesses in the target's security program before they become the buyer's problem.
Remediation Costs
Estimate the cost of closing gaps so it can be considered in the deal.
Post-Close Planning
Plan the security work needed after close, when cybersecurity risk often increases.
Volunteer-Driven & Creative Commons Licensed
SCF CORE MA&D is developed by volunteer cybersecurity practitioners and released under a Creative Commons license. There is no cost to access or implement it.
A Full Picture of The Target's Security Program
Because a transaction can expose almost any part of a business, SCF CORE MA&D reaches across nearly every SCF domain. Examples include:
Governance & Compliance
How security, compliance and resilience responsibilities are assigned, documented and overseen
Data Privacy
How personal data is collected, used, retained and protected, and whether privacy obligations are met
Data Classification & Handling
Where sensitive and regulated data lives and who can access it
Identity & Access
Account management, privileged access and authentication practices
Monitoring & Incident Response
The ability to detect, investigate and respond to security events
Asset & Configuration Management
Inventories, secure configurations and the condition of the technology environment
Third-Party Management
Dependencies on suppliers and service providers that transfer with the business
Business Continuity
Backup, recovery and continuity capabilities that support the business after close
Secure Development
How software and technology products are built and maintained
AI & Autonomous Technologies
How the target governs the AI systems it builds or uses
The complete control set is in the SCF download and is updated with each SCF release.
Who Uses SCF CORE MA&D
Acquiring Entity
Agrees on the control set and assessment boundary with the target, reviews the results and plans post-close integration.
Entity Being Acquired
Prepares its security program for review, completes an internal assessment and provides evidence to the assessor.
Third-Party Assessor
Tests the controls independently and reports conformity and projected remediation costs to both parties.
SCF CORE MA&D pairs with the SCF's free MA&D content, which describes the assessment process from scoping and materiality through the post-close integration plan.
%20(white).png)