.png)
%20color%20with%20text.png)
Three Organizations, One Initiative
SAICO certifies the people, The Cyber AB accredits the organizations they work for, and the SCF Council writes the material they learn.
%20(white).png)
The SCF Council writes the content. It owns the control set, the body of knowledge and the assessment guides, but it does not accredit assessors or issue certifications.
%20Ecosystem%20-%20SCR%20Ecosystem%202026%20draft1%20(1).png)
The Cyber AB is the Accreditation Body for the SCR CAP and the same body that operates in the CMMC ecosystem. It decides who is qualified to assess and support organizations, and it lists them in the SCF Marketplace.
The Cyber EF is an entity of The Cyber AB dedicated to sustained engagement with CMMC and SCF stakeholders through training, education, outreach and market facilitation.
Individual certifications sit with SAICO, the SCR Assessor and Instructor Certification Organization.
Which Track Is Right For You?
SCR Practitioner
This foundation-level certification suits GRC analysts, security program managers, compliance officers and IT security professionals who implement or manage SCF-aligned controls.
SCR Architect
This design and implementation certification suits CISOs, security architects, program directors and senior security engineers who design and run SCF-based programs.
SCR Assessor
This assessment and audit certification suits assessors, auditors, consultants and compliance professionals who conduct third-party assessments. It is the required credential for individuals performing SCR CAP assessments as part of an accredited 3PAO.
Each certification has its own scope, audience and learning objectives. All three are self-paced Computer-Based Training (CBT) that follows a defined syllabus matched to its exam.
SCR Practitioner
- Structure and architecture of the Secure Controls Framework®
- SCF control domains and control objectives
- Common Controls Framework® (CCF) and its use in practice
- Secure, Compliant & Resilient (SCR) fundamentals
- How to implement and track SCF-based controls
- SCF's relationship to laws, regulations, and frameworks
SCR Architect
- Designing SCF-based security programs aligned to business requirements
- Control selection, rationalization, and tailoring using the SCF
- Implementing the Secure, Compliant & Resilient Management System (SCRMS)
- Mapping organizational obligations to SCF control families
- Minimum Security Requirements (MSR) development
- SCF integration with GRC platforms and tooling
SCR Assessor
- SCR CAP assessment methodology and process
- Examine, interview, and test (EIT) assessment techniques
- Evidence collection, evaluation, and documentation
- Assessment Objective (AO) evaluation procedures
- SCR CAP report writing and findings documentation
- Roles and responsibilities within the SCR CAP Ecosystem
Two more options are planned: the SCR Trainer certification, which is expected in 2027, and the SCR Licensed Training Provider (LTP) role.