Updates the risk and threat catalogs to support materiality decisions and adds mappings for NIS2, FedRAMP R5 and the SEC cybersecurity rule.
Measure
SCF 2023.2
SCF 2023.3
Change
Total Controls
1168
1168
Domains
33
33
Laws, Regulations & Frameworks
195
229
With Published STRM
7
What Changed In This Release
Risk and threat models updated to help with materiality decisions.
Terminology standardized, including External Service Provider (ESP) in place of Third-Party Service Provider (TSP).
7 new controls, including Risk Appetite and Threat Catalog; 30 renamed and 11 wordsmithed.
New mappings include NIS2, FedRAMP R5, the draft NIST CSF 2.0, the SEC Cybersecurity Rule, the EU-US Data Privacy Framework, MITRE ATT&CK and the PCI DSS SAQs.
%20(white).png)
.png)