SCF 2025.4

Dec 29, 2025

Minor

Adds PPTDF applicability to Assessment Objectives, 31 new privacy and risk controls, and 12 new laws, regulations and frameworks.

Measure

SCF 2025.3.1

SCF 2025.4

Change

Total Controls

1420

1451

Domains

Laws, Regulations & Frameworks

259

261

With Published STRM

103

What Changed In This Release

Assessment Objectives now tagged by People, Process, Technology, Data or Facility (PPTDF).
31 new controls, led by Data Privacy (PRI, 22), covering automated decision-making, data brokers and opt-out rights, plus 7 risk management controls.
12 added, including ISO 27701:2025, ISO 29100:2024, SIG 2025, GovRAMP, CCPA 2025 and India SEBI CSCRF.
6 retired: ISO 27001:2013, ISO 27002:2013, ISO 29100:2011, NIST CSF 1.1, PCI DSS 3.2 and SIG 2023.