SCF APIv2026.3

The Secure Controls Framework as a validated, versioned, static JSON API — parsed from the official SCF workbook, gated on cross-sheet referential integrity, and rebuilt automatically on every upstream release. No auth, no rate limits, plain files.

1,591controls

34families

270crosswalks

6,446assessment objectives

422evidence requests

1,397compensating controls

Try it

# one control, with its framework crosswalks
curl -s https://sc2in.github.io/scf/api/controls/GOV-01.json | jq .title

# everything SCF maps to NIST SP 800-53 R5
curl -s https://sc2in.github.io/scf/api/crosswalks/general-nist-800-53-r5-2.json | jq .scf_to_framework

Endpoints

`api/summary.json`	Version, all counts, weight distribution.
`api/controls.json`	All controls with full metadata and crosswalks.
`api/families.json`	Family index.
`api/crosswalks.json`	Framework index.
`api/threats.json`	Threat catalog.
`api/risks.json`	Risk catalog.
`api/assessment-objectives.json`	All assessment objectives.
`api/evidence-requests.json`	Evidence request list.
`api/compensating-controls.json`	Compensating control guidance.
`api/privacy-principles.json`	Data privacy management principles.
`api/legacy-map.json`	Old→new control ids, SCF 2026.2 → 2026.3.

Detail endpoints

`api/controls/{ID}.json`	single control (e.g., GOV-01)
`api/families/{CODE}.json`	family detail (e.g., GOV)
`api/crosswalks/{FW_ID}.json`	bidirectional crosswalk
`api/threats/{ID}.json`	single threat (e.g., NT-1)
`api/risks/{ID}.json`	single risk (e.g., R-AC-1)
`api/assessment-objectives/{SCF_ID}.json`	AOs for a control
`api/evidence-requests/{ERL_ID}.json`	evidence request (e.g., E-GOV-01)
`api/compensating-controls/{SCF_ID}.json`	compensating controls

Agents

llms.txt · llms-full.txt · api/docs.md

SCF v2026.3, format-shifted verbatim from the official workbook — content © Secure Controls Framework Council, CC BY-ND 4.0. Pipeline: sc2in/scf (AGPL-3.0), maintained by SC2. Every release ships its validation report.