SEARCH
Download The SCF
SEARCH
Start Here
▾
Start Here
What Is The SCF?
Common Controls Framework (CCF)
SCRMS – How To Implement The SCF
SCF Domains & Principles
ESG Considerations
Included Laws, Regulations & Frameworks (LRF)
Set Theory Relationship Mapping (STRM)
NIST OLIR Participation
Content
▾
Free Content
Premium Content
SCF Download
Secure, Compliant & Resilient Management System (SCRMS)
SCRMS Prioritized Implementation Guide (SCRMS PIG)
Risk Management Model (SCR-RMM)
Capability Maturity Model (SCR-CMM)
Cybersecurity Assessment Standards (CDPAS)
Mergers, Acquisitions & Divestitures (MA&D)
Data Privacy Management Principles (DPMP)
Evidence Request List (ERL)
Unified Scoping Guide (USG)
Compensating Controls
Policies & Standards - SCRP
Procedures - CSOP
SCF CORE
▾
SCF CORE
SCF CORE Fundamentals
SCF CORE Modern Services Organizations (MSO)
SCF CORE MA&D
SCF CORE AI-Enabled Operations
SCF CORE AI Model Deployment
GRC Fundamentals
▾
GRC Fundamentals
GRC Basics
The Output of GRC Practices
Cybersecurity Materiality
Laws vs Regulations vs Frameworks
CMMC vs NIST 800-171 vs SCF
Emerging Trends
State Of The Industry
TPRM & SCRM
Integrity
Resilience
MSP / MSSP Dumpster Fire
Common Cybersecurity Laws
US (FED) - FedRamp
US (FED) - GLBA
US (FED) - HIPAA / HITECH
US (FED) - SOX
US (CA) - CCPA / CPRA
US (TX) - SB 2610
EU - DORA
EU - GDPR
EU - NIS2 Directive
Common Cybersecurity Frameworks
CIS Critical Security Controls (CSC)
ISO 27001 / ISO 27002
NIST CSF 2.0
NIST SP 800-53
NIST SP 800-161
NIST SP 800-171
NIST SP 800-172
PCI DSS
Trust Services Criteria (SOC 2)
Metaframework - HITRUST
Metaframework - Unified Compliance (UC)
Common Cybersecurity Regulations
US (FED) - CMMC
US (FED) - DFARS 252.204-70xx
US (NY) - NY DFS 23 NYCRR Part 500
Word Crimes
Policy vs Standard vs Procedure
Risks vs Threats
Strategy vs Operations vs Tactics
Inheritance vs Reciprocity
SCR Initiative
▾
SCR INITIATIVE
SCR Ecosystem
Cyber Engagement Forum (Cyber EF)
Cyber Accreditation Body (Cyber AB)
Organization-Level SCR Certifications
SCR Conformity Assessment Program (CAP)
SCR Assessment Guides
SCR Training & Individual-Level Certifications
SCR Practitioner
SCR Architect
SCR Assessor
Secure Code Alliance (SCA)
SCA Practitioner
SCA Architect
Secure Development Organization (SDO)
Certified Organization for Development Excellence (CODE)
Marketplace
▾
Marketplace
SCF Licensed Content Providers (LCPs)
Registered Provider Organizations (RPOs)
Control Assurance Tool (CAT)
Authorized Solution Provider (ASP)
Third-Party Assessment Organizations (3PAOs)
FAQ
About
Contact Us
Home
›
Errata
›
SCF 2024.3
SCF 2024.3
Sep 25, 2024
Minor
Adds possible solutions by business size and new supply chain risks and threats.
Measure
SCF 2024.2.1
SCF 2024.3
Change
Total Controls
1234
1239
Domains
33
33
Laws, Regulations & Frameworks
243
252
With Published STRM
27
37
5
What Changed In This Release
Possible solutions and considerations now cover BLS firm size classes 1 to 9.
6 new supply chain risks and 7 new threats, including Foreign Ownership, Control or Influence (FOCI), Sanctions and Counterfeit Products.
5 new controls, including TDA-01.4 DevSecOps and NET-06.7 Software Defined Networking; 10 renamed and 6 wordsmithed.
STRM added for PCI DSS v4, CIS CSC 8.0, CMMC Level 1, NIST 800-171A, TISAX ISA v6.0.3, Australia ISM June 2024 and New Zealand HISF 2022.