Tools To Operationalize The SCF

A common issue for organizations is finding technology solutions that can help operationalize the SCF. Many of these tool providers are Governance, Risk & Compliance (GRC) or Integrated Risk Management (IRM) tools that are capable to taking the SCF's Excel spreadsheet and turning it into a SaaS-based solutions. These tools can be extremely helpful in tailoring the SCF for your specific needs and assigning controls to the appropriate individuals, as well as reporting on the overall status of your organization's cybersecurity and data privacy programs.

SCF Technology Partners

The following organizations have asked to be listed as a SCF-supporting tool. It is your organization's obligation to perform due diligence activities to ensure any organization you choose to work with has the appropriate competence to adequately support your specific needs:

	SCF Connect Website: https://scfconnect.com Email: support@scfconnect.com	Service Description: SCF Connect is your one-stop shop for operationalizing the Secure Controls Framework (SCF). SCF Connect was created specifically to provide a cost effective way to operationalize the SCF by building a native platform to implement, manage, and report on your cybersecurity program. SCF Connect is the official platform for the SCF Conformity Assessment Program (SCF-CAP) to serve as a Single Source of Truth (SSoT) for SCF Assessments. SCF Connect can integrate with other GRC platforms, but an SCF Connect account is needed for an organization to undergo SCF-related Third-Party Assessment, Attestation & Certification Services (3PAAC Services). Please note that SCF Connect is an independent organization from both the SCF Council and SCF Accreditation Body (SCF-AB). The integration of the SCF logo is due to it being the official tool for the SCF CAP. SCF Connect was designed from the ground up to operationalize the SCF - it is for GRC professionals, since it was built by GRC professionals. SCF Connect used GRC experts to architect GRC platform that is efficient, cost-effective and gets the job done.
	SureCloud Website: https://surecloud.com Email: sales@surecloud.com	Service Description: SureCloud and Secure Controls Framework (SCF) have been in close partnership since 2020. SureCloud has embedded the SCF’s control set within its market-leading cloud-based Compliance solution. With the click of a button, SureCloud Compliance users can load any of SCF’s content directly into their control library, along with all regulatory mappings and associated data. SureCloud leverage our partnership with SCF to ensure organizations implement the most appropriate controls for their industry. Within the SureCloud Compliance solution, all SCF controls are mapped against statutory and regulatory frameworks, enabling individual organizations to quickly ascertain which controls it needs to comply with their specific needs. SureCloud's clients are predominantly enterprise organizations with annual revenues within the range of $100m-1bn. SureCloud is strongest within the following industries: Financial Services Retail Manufacturing Technology National and local government
	RegScale Website: https://regscale.com Email: sales@regscale.com	Service Description: RegScale has digitized the Secure Controls Framework (SCF) and made it freely available as a catalog for use in our completely free Community Edition GRC platform, upconvertable to Enterprise Edition. RegScale provides market-leading support for NIST’s Open Security Controls Assessment Language (OSCAL), allowing users of the free Community Edition to produce catalogs (e.g. SCF) and associated content in OSCAL. RegScale frees organizations from manual, paper-based processes via its continuous compliance automation software. Our API-centric software integrates with your existing security and compliance platforms to dynamically manage the security control state, shifting compliance left to deliver audit-ready documentation on demand in the world’s first real-time Governance, Risk, and Compliance platform. Heavily Regulated Organizations such as the U.S. Navy, Department of Energy, and Fortune 500 companies use RegScale to start and stay compliant with their ongoing regulatory obligations.
	LogicGate Website: https://logicgate.com Email: sales@logicgate.com	Service Description: At LogicGate, we’re hyper-focused on equipping customers with everything they need to centralize, streamline, and mature their GRC programs. Providing Secure Controls Framework (SCF) content within Risk Cloud® empowers our customers with expanded resources, flexible control mapping capabilities through the graph database, and time-saving automations so they can further reduce manual tasks and build a connected view of their risks, assets, and controls. LogicGate is redefining the way businesses think about risk with Risk Cloud, its market-leading governance, risk, and compliance (GRC) platform. Risk Cloud is a no-code GRC platform that scales and adapts to organizations’ changing business needs and regulatory requirements. It provides solutions for every GRC use case from one integrated platform to help you build, evolve, and communicate a market-leading risk strategy and program. Hundreds of customers rely on Risk Cloud to improve organizational efficiency, reduce costs, and enable revenue generation and retention.
	SimpleRisk Website: https://simplerisk.com Email: support@simplerisk.com	Service Description: SimpleRisk is a comprehensive GRC platform that can be used for all of your Governance, Risk Management and Compliance needs. The "SCF Extra" is a direct integration between the Secure Controls Framework (SCF) and SimpleRisk. Enabling it allows you to select from 190 different frameworks that have been mapped to 1,057 security and privacy related common controls. This includes many frameworks heavily used by organizations today, such as ISO 27001, NIST CSF, PCI DSS, GDPR, COBIT, COSO and more! The SimpleRisk Core can be downloaded for free from the SimpleRisk website, installed in minutes, and provides all of the capabilities that you need when first launching your GRC program. As your organization grows and matures its processes, our SimpleRisk Extras are licensed modules that provide enhanced functionality on par with competitors that cost orders of magnitude more and require months of professional services to install and configure. There's no need to waste all of that time and money when you can be up and running with SimpleRisk today: Rapid implementation - From “zero to GRC” in a matter of minutes Support both Hosted and On-Premise deployment models Bundled packages with built-in discounts or A La Carte Extras available Simple, intuitive, comprehensive and highly configurable Responsive and knowledgeable customer support
	Ostendio Website: https://ostendio.com Email: info@ostendio.com	Service Description: Ostendio fully integrates the Secure Controls Framework's (SCF) controls and allows organizations to easily compare their security program against over 150 security and privacy frameworks by simply mapping the controls necessary for any additional standard or regulation. Ostendio has clients in all industries including health, medical devices, education, technology, and finance. Ostendio also works with auditors and MSPs helping clients work more efficiently and effectively with security, compliance, and audit preparation. At Ostendio our goal is to make #EveryoneSecure by involving all your employees in security, not just the IT team. Ostendio is the only risk management platform that goes beyond a GRC platform to strengthen your business operations, supply chain, and everyone you rely on with continuous security that is always on and always advancing. With layers of protection that provide critical support for your unique risk management domains, Ostendio extends to every part of your business.
	ProcessUnity Website: https://processunity.com Email: info@processunity.com	Service Description: ProcessUnity for Cybersecurity Risk Management contains all Secure Controls Framework's (SCF) controls and risks as a best practice starting point. The solution guides the user through control library creation with several clicks to select their relevant requirements. Then, the organization’s unique policies can be manually mapped to the out-of-the-box control library. Control assessment workflows are aligned to the SCF Cybersecurity & Data Privacy Capability Maturity Model (C\|P-CMM) to assign control maturity ratings. The solution automatically collects against a control, then the user can assign control ratings and create action plans for improvements. Risk assessment workflows are aligned to the Cybersecurity & Data Privacy Risk Management Model (C\|P-RMM), including inherent and residual risk calculations. Action plans can be created directly from a risk review for clear line-of-sight into improvements. Risk data is stored and tracked in a central risk register. The solution generates real-time reports on all SCF controls and risks data, such as control maturity by domain, program control consolidation and risk trends. ProcessUnity serves organizations of all industries, maturities, and sizes. Our solution is content agnostic and highly flexible across different requirements. ProcessUnity combines a best-practice cybersecurity risk program with a configurable, flexible platform. Our solutions cover over fifty use cases, allowing teams with the ability to fully configure their solutions, automate workflows, generate real-time reports and seamlessly integrate with other department’s systems. Our team brings over 800 years of combined experience in risk and compliance to our customer implementations. We are committed to building scalable programs that can connect with other departments only when they are ready, and we offer hands-on guidance to fully support the user through their program’s growth.
	Ignyte Assurance Platform Website: https://ignyteplatform.com Email: info@ignyteplatform.com	Service Description: Ignyte’s GRC automation-based software platform covers a broad spectrum of features to manage Secure Controls Framework (SCF) compliance and maintain continuous monitoring as an integrated part of the Ignyte Platform. We help organizations within the Defense Industrial Base, Public Sector, Healthcare, and other industries looking to go beyond checklists. Ignyte’s platform feature set includes: Compliance Management to manage, measure, and cross-map regulations, standards and guidelines, and workflows. IT Asset Management to maintain compliance and identify potential risks, and create relationships between assets as well as compliance systems and control records. Reporting Module to generate preformatted reports that provide a framework to capture the system environment, system responsibilities, and the current status of the controls required for the system. Dashboard Module to quickly view the status of your SCF program. Vendor Risk Management to manage your third party providers assessments, shared assessment questionnaires, automated risk grading, remediation workflows, and customizable vendor risk reporting. Audit Management to automate repetitive tasks, such as annual or triennial audits, and tracking open findings in remediation using robust workflows. Incident Management to help manage and respond to unplanned events or service interruptions, track restoration progress, automate notification to SMEs to help resolve issues, and capture critical information. Vulnerability Management to continuously monitor and respond to pressing, complex issues – an essential to risk management and information security through vulnerability scanning and patching.
	StandardFusion Website: https://standardfusion.com Email: sales@standardfusion.com	Service Description: StandardFusion is dedicated to providing a streamlined and efficient approach to GRC, incorporating the Secure Controls Framework (SCF) and other critical cybersecurity frameworks into our platform. By integrating these frameworks, we offer our clients comprehensive resources, advanced control mapping, and automation capabilities. This enables organizations to simplify their GRC activities, reduce manual efforts, and gain a cohesive understanding of their risk landscape and compliance status. StandardFusion is designed to serve a broad spectrum of sectors, including technology, finance, healthcare, and manufacturing. Our platform's versatility and adaptability make it an ideal choice for any organization looking to enhance their GRC practices. StandardFusion stands out by embracing and simplifying the complexities of GRC. Unlike standalone solutions, our platform integrates governance, risk management, compliance, and privacy processes into one unified system. This approach not only builds trust and integrity but also supports proactive management and strategic decision-making across your organization. With StandardFusion, businesses can confidently navigate the evolving landscape of regulations and threats, ensuring they remain compliant and secure.
	Compliance Scorecard Website: https://compliancescorecard.com Email: info@compliancescorecard.com	Service Description: Compliance Scorecard integrates Secure Controls Framework (SCF) controls, enabling organizations to align and compare their security programs with multiple frameworks. This integration streamlines compliance processes, enhancing adherence to diverse regulatory standards. Compliance Scorecard supports MSPs across healthcare, education, technology, and finance, offering tools that simplify compliance, security, and audit preparation. This platform helps MSPs and their clients manage compliance demands efficiently, allowing them to focus more on core business functions. Compliance Scorecard transforms compliance management for MSPs by simplifying the policy and assessment lifecycle. Our multi-tenant platform acts as a centralized hub for compliance documentation, streamlining management, attestation, and governance. Key Features: Policy Management: Facilitate easy updates and audits with structured documentation. Compliance Assessments: Automate compliance checks aligned with frameworks like NIST and CIS, keeping you ahead of regulatory changes. Risk Register: Efficiently track risks and mitigation plans. Asset Management: Maintain a detailed inventory of IT assets for comprehensive compliance oversight. Customizable Reporting: Generate reports that provide insights into compliance status, aiding decision-making and audit preparation. API Integrations: Sync with tools like Liongard and M365 without disrupting existing workflows.
	360inControl Website: https://360incontrol.com Email: info@360incontrol.ch	Service Description: Secure Controls Framework (SCF) controls can be uploaded to 360inControl® with just a few clicks. SCF controls can be used immediately in self-assessments, supplier audits, etc. The uploaded controls can be extended at any time. If the analysis shows a need for improvement, you can directly enter an action item and assign it to anyone in your organization. The improvement plans can be monitored until closure and later re-evaluation. 360inControl is content and industry neutral and therefore also ideal for SMEs and startups. 360inControl offers a simple, digital and scalable platform for governance, risk and compliance management. 360inControl's service team accompanies you during the implementation and in daily operation. The license model allows all employees (internal & external) to use the platform.
	GRC Toolbox Website: https://swissgrc.com Email: sales@swissgrc.com	Service Description: The GRC Toolbox by Swiss GRC is a software solution for governance, risk, compliance (GRC) and information security (ISMS). Companies and organizations worldwide rely on the GRC Toolbox enabling them to fulfill their cyber security and privacy needs collaboratively. By leveraging the Cybersecurity & Data Privacy Capability Maturity Model (C\|P-CMM), the GRC Toolbox provides an efficient method to run capability maturity assessments and more. The Secure Controls Framework (SCF) is integrated as a standard within the GRC Toolbox and can be used and mapped with all core processes of the ISMS such as: Asset Management, including Protection Requirement Assessment (CIA classification) as a basis for corresponding assessment activities e.g. risk and control assessment Security Assessment Management, for assessments and evaluation to ensure, that all security requirements are fulfilled or if further actions must be taken. IT Risk Management, to identify, assess and mitigate risks with the help of the SCF - Controls Security Measures, for documentation and tracking resulting from Assessment Evaluations, Risk assessments, Security Exceptions etc. Security Exceptions, for non-compliance against Security Controls and requirements