The program language moves to Security, Compliance & Resilience, with 17 new controls, proposed compensating controls, 13 authoritative sources added and 24 retired.
Measure
SCF 2025.4
SCF 2026.1
Change
Total Controls
1451
1468
Domains
33
33
Laws, Regulations & Frameworks
261
253
With Published STRM
103
185
17
What Changed In This Release
Governance controls renamed around the Security, Compliance & Resilience Program (SCRP); 42 renamed and 114 wordsmithed.
17 new controls, including FOCI, WORM event logs and mutual authentication.
Proposed compensating controls, plus updated maturity criteria and possible solutions.
13 sources added, including IEC 62443-2-1 (2024), OWASP Top 10 (2025), CJIS v6.0 and SIG 2025.
24 sources retired, including FedRAMP R4, FFIEC, HICP and ITAR.
%20(white).png)
.png)