{ "total": 263, "privacy_principles": [ { "principle_name": "Data Privacy by Design", "description": "Establish and maintain a comprehensive data privacy program that ensures data privacy considerations are addressed by design in the development of policies, standards, processes, systems, applications, projects and third-party contracts.", "scf_control": "Security, Compliance & Resilience Program (SCRP)", "scf_control_id": "GOV-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF6" ], "ISO 27701 2025": [ "5.1", "6.1.3(c)", "7.5.1" ], "NIST 800-53 R5.2": [ "PM-01" ], "NIST CSF 2.0": [ "GV", "GV.RM-01", "GV.RM-03", "GV.RR-01", "GV.SC", "GV.SC-01", "GV.SC-03", "GV.SC-09", "ID.RA", "PR", "PR.IR" ], "NIST Privacy Framework 1.0": [ "ID-P", "ID.BE-P", "GV-P", "GV.PO-P1", "GV.PO-P6", "CM-P", "CM.PO-P", "PR-P", "PR.PT-P" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)", "§ 164.306(a)(2)", "§ 164.306(a)(3)", "§ 164.316(a)", "§ 164.530(c)(1)", "§ 164.530(i)(1)" ], "USA California CCPA 2025": [ "7123(b)(1)" ], "USA Vermont Act 171 2018": [ "2447(a)(1)", "2447(a)(1)(A)", "2447(a)(1)(B)", "2447(a)(1)(C)", "2447(a)(1)(D)", "2447(b)", "2447(c)" ] } }, { "principle_name": "Data Privacy by Design", "description": "Establish and maintain a comprehensive data privacy program that ensures data privacy considerations are addressed by design in the development of policies, standards, processes, systems, applications, projects and third-party contracts.", "scf_control": "Data Privacy Program", "scf_control_id": "PRI-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0", "M1.2", "N2.2-POF1", "D6.1-POF1" ], "APEC Privacy Framework 2015": [ "1", "9" ], "ISO 27701 2025": [ "4.4", "5.1", "6.1.1", "6.1.1(a)", "6.1.1(b)", "6.1.3(h)", "6.2", "6.2(a)", "6.2(b)", "6.2(c)", "6.2(d)", "6.2(e)", "6.2(f)", "6.2(g)", "6.3", "7.1", "7.4", "7.5.1", "7.5.1(a)", "7.5.1(b)", "7.5.2", "7.5.3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "PM-18", "PT-01" ], "NIST CSF 2.0": [ "GV.OC-03" ], "NIST Privacy Framework 1.0": [ "GV.PO-P1", "GV.PO-P5", "GV.PO-P6", "GV.MT-P", "CT-P", "CT.PO-P2", "CT.DM-P", "CT.DP-P", "CM.PO-P1", "CM.AW-P", "PR.PO-P9" ], "OECD Privacy Principles": [ "8" ], "USA Federal Data Privacy Framework 2023": [ "III.15.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)", "§ 164.530(a)(1)(i)", "§ 164.530(i)(1)", "§ 164.530(i)(4)(i)(A)", "§ 164.530(i)(4)(i)(B)", "§ 164.530(i)(5)", "§ 164.530(i)(5)(i)", "§ 164.530(i)(5)(ii)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7002(a)" ], "USA Texas CDPA 2025": [ "541.101(a)(2)", "541.101(b)(2)", "541.204(c)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.3" ], "EMEA EU GDPR 2016": [ "Article 5.1(a)", "Article 9.1", "Article 12.2" ] } }, { "principle_name": "Data Privacy by Design", "description": "Establish and maintain a comprehensive data privacy program that ensures data privacy considerations are addressed by design in the development of policies, standards, processes, systems, applications, projects and third-party contracts.", "scf_control": "Reasonable Data Privacy Practices", "scf_control_id": "PRI-09", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.2-POF1" ], "APEC Privacy Framework 2015": [ "2-1", "2-2" ], "ISO 29100 2024": [ "6.5", "6.8", "6.10" ], "NIST Privacy Framework 1.0": [ "GV.PO-P5", "GV.MT-P3", "GV.MT-P5", "CT.PO-P1", "CM.AW-P2", "CM.AW-P3" ], "USA Federal FIPPS 1973": [ "2", "4" ], "USA California CCPA 2025": [ "7002(b)", "7002(b)(1)", "7002(b)(2)", "7002(b)(3)", "7002(d)", "7002(d)(1)", "7002(d)(2)", "7027(m)", "7027(m)(1)", "7027(m)(2)", "7027(m)(3)", "7027(m)(4)", "7027(m)(5)", "7027(m)(6)", "7027(m)(7)", "7027(m)(8)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(2)(a)", "6-1-1305(4)", "6-1-1308(3)", "6-1-1308(4)", "6-1-1308(5)", "6-1-1308(7)" ], "USA Illinois BIPA 2008": [ "15(e)(1)", "15(e)(2)" ], "USA Illinois IPA 2009": [ "10(a)(3)", "10(b)(2)", "10(b)(3)", "10(c)(3)", "10(c)(4)", "10(c)(6)", "10(d)" ], "USA Illinois PIPA 2006": [ "45(a)" ], "USA Montana CDPA 2025": [ "30-14-2811(1)(a)" ], "USA Nevada Privacy Law 2023": [ "603A.210.1", "603A.510.3(b)", "603A.525.1", "603A.525.1(a)", "603A.525.1(b)", "603A.525.2(c)" ], "USA Oregon 646A 2025": [ "646A.578(1)(c)", "646A.578(2)(a)", "646A.578(2)(b)", "646A.578(2)(c)", "646A.578(2)(d)", "646A.581(1)", "646A.581(1)(a)", "646A.581(1)(b)", "646A.581(1)(c)", "646A.583(1)(b)" ], "USA Texas BC521 2009": [ "521.051(a)", "521.052(a)" ], "USA Virginia CDPA 2023": [ "59.1-577.1.B", "59.1-577.1.C", "59.1-577.1.E", "59.1-578.A.4", "59.1-578.F.1.d", "59.1-578.F.2", "59.1-579.A.1", "59.1-579.A.2", "59.1-579.A.3" ], "USA Vermont Act 171 2018": [ "2433(a)(1)", "2433(a)(2)(A)", "2433(a)(2)(B)", "2433(a)(2)(C)", "2447(a)(2)" ], "EMEA UK DPA 2018": [ "Section 45(4)", "Section 45(4)(a)", "Section 45(4)(b)", "Section 45(4)(c)", "Section 45(4)(e)", "Section 47(2)" ], "APAC Australian Privacy Principles 2026": [ "1.1.2", "2.3.1", "2.3.2", "2.3.5", "2.3.7", "2.4.1", "2.4.1.a", "2.4.1.b", "2.4.2", "2.4.3", "2.4.3.a", "2.4.3.b", "2.4.4", "3.9.1", "3.9.1.a", "3.9.1.b", "5.12.7", "5.12.8", "5.12.8.a", "5.12.8.b" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.4", "3.1.22.4(a)", "3.1.22.4(b)", "3.1.22.4(b)(i)", "3.1.22.4(b)(ii)", "3.1.22.5", "3.1.22.5(b)", "4.1.47(1)", "4.1.47(1)(a)", "4.1.47(1)(b)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4(a)", "P3-4.3.3", "P4-4.4.1", "P4-4.4.2" ] } }, { "principle_name": "Data Privacy by Design", "description": "Establish and maintain a comprehensive data privacy program that ensures data privacy considerations are addressed by design in the development of policies, standards, processes, systems, applications, projects and third-party contracts.", "scf_control": "Dissemination of Data Privacy Program Information", "scf_control_id": "PRI-20", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF1" ], "ISO 27701 2025": [ "6.2(e)", "7.4", "7.5.3(a)" ], "ISO 29100 2024": [ "6.8" ], "NIST 800-53 R5.2": [ "PM-20" ], "NIST Privacy Framework 1.0": [ "GV.PO-P1", "CM.PO-P1", "CM.AW-P1" ], "OECD Privacy Principles": [ "6" ], "USA Federal FIPPS 1973": [ "8" ], "USA Montana CDPA 2025": [ "30-14-2815(1)(b)" ], "USA Oregon CPA 2023": [ "Section 7(1)(a)(B)" ], "USA Virginia CDPA 2023": [ "59.1-581.A.2" ] } }, { "principle_name": "Assigned Responsibilities", "description": "Assign accountability through documented roles and responsibilities to qualified data subjects, including key internal and external stakeholders, for maintaining compliance with all applicable data privacy requirements that involves appropriately monitoring and documenting the data privacy program.", "scf_control": "Data Privacy Program", "scf_control_id": "PRI-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0", "M1.2", "N2.2-POF1", "D6.1-POF1" ], "APEC Privacy Framework 2015": [ "1", "9" ], "ISO 27701 2025": [ "4.4", "5.1", "6.1.1", "6.1.1(a)", "6.1.1(b)", "6.1.3(h)", "6.2", "6.2(a)", "6.2(b)", "6.2(c)", "6.2(d)", "6.2(e)", "6.2(f)", "6.2(g)", "6.3", "7.1", "7.4", "7.5.1", "7.5.1(a)", "7.5.1(b)", "7.5.2", "7.5.3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "PM-18", "PT-01" ], "NIST CSF 2.0": [ "GV.OC-03" ], "NIST Privacy Framework 1.0": [ "GV.PO-P1", "GV.PO-P5", "GV.PO-P6", "GV.MT-P", "CT-P", "CT.PO-P2", "CT.DM-P", "CT.DP-P", "CM.PO-P1", "CM.AW-P", "PR.PO-P9" ], "OECD Privacy Principles": [ "8" ], "USA Federal Data Privacy Framework 2023": [ "III.15.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)", "§ 164.530(a)(1)(i)", "§ 164.530(i)(1)", "§ 164.530(i)(4)(i)(A)", "§ 164.530(i)(4)(i)(B)", "§ 164.530(i)(5)", "§ 164.530(i)(5)(i)", "§ 164.530(i)(5)(ii)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7002(a)" ], "USA Texas CDPA 2025": [ "541.101(a)(2)", "541.101(b)(2)", "541.204(c)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.3" ], "EMEA EU GDPR 2016": [ "Article 5.1(a)", "Article 9.1", "Article 12.2" ] } }, { "principle_name": "Assigned Responsibilities", "description": "Assign accountability through documented roles and responsibilities to qualified data subjects, including key internal and external stakeholders, for maintaining compliance with all applicable data privacy requirements that involves appropriately monitoring and documenting the data privacy program.", "scf_control": "Data Privacy Accountability Structure", "scf_control_id": "PRI-03", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF2", "M1.2-POF4" ], "NIST 800-53 R5.2": [ "PM-18" ] } }, { "principle_name": "Assigned Responsibilities", "description": "Assign accountability through documented roles and responsibilities to qualified data subjects, including key internal and external stakeholders, for maintaining compliance with all applicable data privacy requirements that involves appropriately monitoring and documenting the data privacy program.", "scf_control": "Chief Privacy Officer (CPO)", "scf_control_id": "PRI-03.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF1", "N2.2-POF1" ], "APEC Privacy Framework 2015": [ "9" ], "ISO 27701 2025": [ "5.1", "5.3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "PM-19" ], "NIST Privacy Framework 1.0": [ "GV.PO-P3" ], "OECD Privacy Principles": [ "8" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.530(a)(1)(i)" ], "USA Federal FIPPS 1973": [ "2" ], "Americas Canada PIPEDA 2000": [ "P1-4.1", "P1-4.1.1", "P1-4.1.2" ] } }, { "principle_name": "Assigned Responsibilities", "description": "Assign accountability through documented roles and responsibilities to qualified data subjects, including key internal and external stakeholders, for maintaining compliance with all applicable data privacy requirements that involves appropriately monitoring and documenting the data privacy program.", "scf_control": "Data Protection Officer (DPO)", "scf_control_id": "PRI-03.2", "crosswalks": { "ISO 29100 2024": [ "6.10" ], "NIST Privacy Framework 1.0": [ "GV.PO-P3", "CT.PO-P2", "CM.PO-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.530(a)(1)(ii)" ], "EMEA EU GDPR 2016": [ "Article 27.1", "Article 27.3", "Article 27.4", "Article 27.5", "Article 35.2", "Article 37.1", "Article 37.1(a)", "Article 37.1(b)", "Article 37.1(c)", "Article 37.2", "Article 37.3", "Article 37.4", "Article 37.5", "Article 37.6", "Article 37.7", "Article 38.1", "Article 38.2", "Article 38.3", "Article 38.4", "Article 38.5", "Article 38.6", "Article 39.1", "Article 39.1(a)", "Article 39.1(b)", "Article 39.1(c)", "Article 39.1(d)", "Article 39.1(e)", "Article 39.2" ], "EMEA UK DPA 2018": [ "Section 69(1)", "Section 69(2)", "Section 69(2)(a)", "Section 69(2)(b)", "Section 69(3)", "Section 70(1)", "Section 70(2)", "Section 70(2)(a)", "Section 70(2)(b)", "Section 70(3)", "Section 70(3)(a)", "Section 70(3)(b)", "Section 70(3)(c)", "Section 70(4)", "Section 70(4)(a)", "Section 70(4)(b)", "Section 70(5)", "Section 71(1)", "Section 71(1)(a)", "Section 71(1)(b)", "Section 71(1)(c)", "Section 71(1)(d)", "Section 71(1)(e)", "Section 71(1)(f)", "Section 71(2)", "Section 71(2)(a)", "Section 71(2)(b)", "Section 71(2)(c)", "Section 71(2)(d)", "Section 71(3)" ] } }, { "principle_name": "Data Classification", "description": "Classify data according to the sensitivity and type of personal data as defined by appropriate statutory, regulatory and contractual contexts.", "scf_control": "Data & Asset Classification", "scf_control_id": "DCH-04", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3" ], "NIST CSF 2.0": [ "ID.AM-05", "PR.DS" ], "USA California CCPA 2025": [ "7123(c)(4)(A)" ] } }, { "principle_name": "Data Classification", "description": "Classify data according to the sensitivity and type of personal data as defined by appropriate statutory, regulatory and contractual contexts.", "scf_control": "Personal Data (PD) Categories", "scf_control_id": "PRI-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3", "M1.3-POF1", "D6.7" ], "NIST 800-53 R5.2": [ "PT-07", "PT-07(01)", "PT-07(02)" ], "NIST Privacy Framework 1.0": [ "ID.IM-P3" ], "USA California CCPA 2025": [ "7024(j)", "7024(l)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(a)(I)" ], "USA Montana CDPA 2025": [ "30-14-2812(5)(a)", "30-14-2812(5)(c)" ], "USA Nevada Privacy Law 2023": [ "603A.340.1(a)" ], "USA Oregon CPA 2023": [ "Section 5(4)(a)", "Section 5(4)(e)" ], "USA Texas CDPA 2025": [ "541.102(a)(1)" ], "USA Virginia CDPA 2023": [ "59.1-578.C.4" ], "EMEA EU GDPR 2016": [ "Article 13.1(e)", "Article 14.1(d)" ] } }, { "principle_name": "Registering Databases", "description": "Register applicable databases containing personal data with the appropriate Data Authority, when required.", "scf_control": "Register As A Data Controller and/or Data Processor", "scf_control_id": "PRI-45", "crosswalks": { "USA Vermont Act 171 2018": [ "2446(a)(1)" ] } }, { "principle_name": "Resource Planning", "description": "Identify and plan for resources needed to operate a data privacy program and include data privacy requirements in solicitations for Technology Assets, Applications and/or Services (TAAS).", "scf_control": "Security, Compliance & Resilience Protection Portfolio Management", "scf_control_id": "PRM-04", "crosswalks": { "ISO 27701 2025": [ "7.1" ], "NIST 800-53 R5.2": [ "PL-01" ], "NIST CSF 2.0": [ "GV.RM", "GV.RR-03" ] } }, { "principle_name": "Inventory of Personal Data", "description": "Maintain an inventory of both the type of personal data and specific data element, as well as the Technology Assets, Applications and/or Services (TAAS) that collect, create, use, disseminate, maintain, and/or disclose that personal data.", "scf_control": "Inventory of Personal Data (PD)", "scf_control_id": "PRI-07", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.4" ], "NIST 800-53 R5.2": [ "PM-05(01)" ], "NIST CSF 2.0": [ "ID.AM-07" ], "NIST Privacy Framework 1.0": [ "ID.IM-P3", "ID.IM-P6" ], "USA California CCPA 2025": [ "7123(c)(4)(A)" ] } }, { "principle_name": "Inventory of Personal Data", "description": "Maintain an inventory of both the type of personal data and specific data element, as well as the Technology Assets, Applications and/or Services (TAAS) that collect, create, use, disseminate, maintain, and/or disclose that personal data.", "scf_control": "Personal Data (PD) Inventory Automation Support", "scf_control_id": "PRI-07.1", "crosswalks": { "NIST 800-53 R5.2": [ "PM-05(01)" ], "NIST Privacy Framework 1.0": [ "ID.IM-P3", "ID.IM-P6" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Security, Compliance & Resilience-Minded Workforce", "scf_control_id": "SAT-02", "crosswalks": { "NIST 800-53 R5.2": [ "AT-01", "PM-13" ], "NIST CSF 2.0": [ "PR.AT" ], "NIST Privacy Framework 1.0": [ "GV.AT-P", "GV.AT-P1", "GV.AT-P2", "GV.AT-P3", "GV.AT-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(i)" ], "USA California CCPA 2025": [ "7123(c)(12)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Security, Compliance & Resilience Awareness Training", "scf_control_id": "SAT-04", "crosswalks": { "NIST 800-53 R5.2": [ "AT-02" ], "NIST CSF 2.0": [ "PR.AT", "PR.AT-01" ], "NIST Privacy Framework 1.0": [ "GV.AT-P1", "GV.AT-P2", "GV.AT-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(i)", "§ 164.530(b)(2)(i)", "§ 164.530(b)(2)(i)(A)", "§ 164.530(b)(2)(i)(B)", "§ 164.530(b)(2)(i)(C)", "§ 164.530(b)(2)(ii)" ], "USA California CCPA 2025": [ "7100(a)", "7123(c)(12)", "7123(c)(13)" ], "USA Vermont Act 171 2018": [ "2447(b)(2)(A)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4(c)", "P7-4.7.4" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Simulated Cyber Attack Scenario Training", "scf_control_id": "SAT-04.1", "crosswalks": { "NIST 800-53 R5.2": [ "AT-02(01)", "AT-06" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Role-Based Security, Compliance & Resilience Training", "scf_control_id": "SAT-05", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF3" ], "ISO 27701 2025": [ "7.2" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "AT-03", "AT-03(02)" ], "NIST CSF 2.0": [ "PR.AT", "PR.AT-01", "PR.AT-02" ], "NIST Privacy Framework 1.0": [ "GV.AT-P1", "GV.AT-P2", "GV.AT-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(ii)(C)", "§ 164.308(a)(5)(ii)(D)", "§ 164.530(b)(1)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7100(a)", "7123(c)(12)", "7123(c)(13)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Sensitive / Regulated Data Storage, Handling & Processing", "scf_control_id": "SAT-05.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "AT-03(05)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7100(a)", "7123(c)(12)", "7123(c)(13)" ], "USA Illinois IPA 2009": [ "35(a)(2)", "37(a)(2)" ], "USA Vermont Act 171 2018": [ "2447(c)(8)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Cyber Threat Environment Situational Awareness", "scf_control_id": "SAT-06", "crosswalks": { "NIST 800-53 R5.2": [ "AT-02(06)" ], "NIST CSF 2.0": [ "PR.AT-01", "PR.AT-02" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(ii)(A)" ], "USA California CCPA 2025": [ "7123(c)(12)", "7123(c)(13)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Suspicious Communications & Anomalous System Behavior", "scf_control_id": "SAT-06.2", "crosswalks": { "NIST 800-53 R5.2": [ "AT-02(04)", "AT-02(05)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(ii)(B)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Practical Security Training Exercises", "scf_control_id": "SAT-09", "crosswalks": { "NIST 800-53 R5.2": [ "AT-03(03)" ] } }, { "principle_name": "Data Privacy Training", "description": "Provide recurring data privacy awareness and training for all employees and contractors.", "scf_control": "Security, Compliance & Resilience Training Records", "scf_control_id": "SAT-10", "crosswalks": { "NIST 800-53 R5.2": [ "AT-04" ], "USA California CCPA 2025": [ "7123(c)(12)", "7123(c)(13)" ] } }, { "principle_name": "Personal Data Categories", "description": "Define and implement data handling and protection requirements for specific categories of sensitive Personal Data (PD).", "scf_control": "Personal Data (PD) Categories", "scf_control_id": "PRI-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3", "M1.3-POF1", "D6.7" ], "NIST 800-53 R5.2": [ "PT-07", "PT-07(01)", "PT-07(02)" ], "NIST Privacy Framework 1.0": [ "ID.IM-P3" ], "USA California CCPA 2025": [ "7024(j)", "7024(l)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(a)(I)" ], "USA Montana CDPA 2025": [ "30-14-2812(5)(a)", "30-14-2812(5)(c)" ], "USA Nevada Privacy Law 2023": [ "603A.340.1(a)" ], "USA Oregon CPA 2023": [ "Section 5(4)(a)", "Section 5(4)(e)" ], "USA Texas CDPA 2025": [ "541.102(a)(1)" ], "USA Virginia CDPA 2023": [ "59.1-578.C.4" ], "EMEA EU GDPR 2016": [ "Article 13.1(e)", "Article 14.1(d)" ] } }, { "principle_name": "Data Subject Communications", "description": "Craft disclosures and communications to data subjects so the material is readily accessible and written in a manner that is concise, unambiguous and understandable by a reasonable person.", "scf_control": "Data Subject Communications", "scf_control_id": "PRI-37", "crosswalks": { "USA California CCPA 2025": [ "7003(a)", "7004(a)(3)", "7222(b)", "7222(b)(1)", "7222(b)(2)", "7222(b)(3)", "7222(b)(3)(A)", "7222(b)(4)", "7222(b)(4)(A)", "7222(c)", "7222(c)(1)", "7222(c)(2)", "7222(c)(2)(A)", "7222(c)(2)(B)", "7222(c)(2)(C)", "7222(d)", "7222(e)", "7222(f)", "7222(g)", "7222(h)", "7222(i)", "7222(j)", "7222(k)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)" ], "USA Virginia CDPA 2023": [ "59.1-577.B.2" ], "EMEA UK DPA 2018": [ "Section 44(5)", "Section 44(5)(a)", "Section 44(5)(b)", "Section 44(5)(c)", "Section 44(5)(d)", "Section 44(5)(e)", "Section 44(6)" ], "APAC Australian Privacy Principles 2026": [ "5.12.9", "5.12.9.a", "5.12.9.b", "5.12.9.c", "5.12.10" ], "APAC New Zealand Privacy Act of 2020": [ "4.1.46(2)(a)", "4.1.46(2)(b)", "4.1.46(3)(a)", "4.1.46(3)(b)" ], "Americas Canada PIPEDA 2000": [ "P9-4.9.4" ] } }, { "principle_name": "Conspicuous Link To Data Privacy Notice", "description": "Design websites and mobile applications to include a conspicuous link to the organization's data privacy notice.", "scf_control": "Conspicuous Link To Data Privacy Notice", "scf_control_id": "PRI-21.2", "crosswalks": { "USA California CCPA 2025": [ "7003(c)", "7003(d)" ], "USA Montana CDPA 2025": [ "30-14-2812(10)" ] } }, { "principle_name": "Notice of Financial Incentive", "description": "Provide data subjects with a Notice of Financial Incentive that explains the material terms of a financial incentive, price or service difference so the data subject can make an informed decision about whether to participate.", "scf_control": "Notice of Financial Incentive", "scf_control_id": "PRI-19.1", "crosswalks": { "USA California CCPA 2025": [ "7010(g)", "7080(e)" ], "USA Montana CDPA 2025": [ "30-14-2809(4)(b)" ] } }, { "principle_name": "Artificial Intelligence (AI) & Automated Decision Making", "description": "Personal Data (PD) and sensitive Personal Data (sPD) used in Artificial Intelligence (AI) and Autonomous Technologies (AAT), including training, fine-tuning, retrieval and inference, must be governed with the same rigor as any other processing activity, with a documented lawful basis and demonstrable data subject rights support.", "scf_control": "Automated Decision-Making Technology (ADMT)", "scf_control_id": "PRI-36", "crosswalks": { "NIST 800-53 R5.2": [ "PM-24", "PT-02(02)", "PT-03(02)" ], "EMEA UK DPA 2018": [ "Section 50B(1)", "Section 50B(2)", "Section 50B(3)", "Section 96(1)", "Section 96(2)", "Section 96(2)(a)", "Section 96(2)(b)", "Section 96(2)(c)", "Section 96(2)(c)(i)", "Section 96(2)(c)(ii)", "Section 96(2)(c)(iii)", "Section 96(3)", "Section 96(4)" ] } }, { "principle_name": "Data Subject Participation", "description": "Data subjects are directly involved in the decision-making process regarding the fair and lawful processing of the individual’s personal data and, to the extent practicable, directly-engaged to receive explicit permission to use their personal data.", "scf_control": "Data Subject Consent", "scf_control_id": "PRI-24", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF1", "C3.1", "C3.1-POF1", "C3.1-POF3", "C3.2", "C3.2-POF2", "C3.2-POF3", "C3.2-POF4" ], "APEC Privacy Framework 2015": [ "2(e)", "4(a)", "5" ], "ISO 29100 2024": [ "6.2" ], "NIST 800-53 R5.2": [ "PT-04" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P3" ], "OECD Privacy Principles": [ "1", "4(a)" ], "USA Federal Data Privacy Framework 2023": [ "II.2.a", "II.2.c" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.506(b)(1)", "§ 164.508(a)(2)", "§ 164.508(c)(1)(v)", "§ 164.508(c)(3)", "§ 164.510(b)(2)(i)", "§ 164.510(b)(2)(ii)", "§ 164.510(b)(2)(iii)", "§ 164.510(b)(3)", "§ 164.514(f)(2)(ii)", "§ 164.514(f)(2)(iv)", "§ 164.514(f)(2)(v)" ], "USA California CCPA 2025": [ "7002(e)", "7010(b)", "7012(a)", "7012(b)", "7012(c)", "7012(d)", "7012(e)", "7012(e)(1)", "7012(e)(2)", "7012(e)(3)", "7012(e)(4)", "7012(e)(5)", "7012(e)(6)", "7027(c)", "7027(d)" ], "USA Illinois BIPA 2008": [ "15(b)(3)", "15(d)", "15(d)(1)", "15(d)(2)", "15(d)(3)", "15(d)(4)" ], "USA Montana CDPA 2025": [ "30-14-2811(3)(a)", "30-14-2811(3)(b)(i)", "30-14-2812(2)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.500.2(a)", "603A.500.2(b)", "603A.500.3", "603A.500.3(a)", "603A.500.3(b)", "603A.500.3(c)", "603A.500.3(d)", "603A.535.5", "603A.535.6", "603A.535.6(a)", "603A.535.6(b)", "603A.535.6(c)", "603A.535.6(d)", "603A.535.7" ], "USA Oregon CPA 2023": [ "Section 5(2)(b)", "Section 5(2)(c)" ], "USA Oregon 646A 2025": [ "646A.578(6)", "646A.583(1)(a)(C)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(E)", "47-18-3203(b)", "47-18-3204(a)(6)" ], "USA Texas CDPA 2025": [ "541.101(b)(4)", "541.107(a)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.5", "59.1-578.D" ], "EMEA EU GDPR 2016": [ "Article 7.1", "Article 7.2", "Article 9.2(a)", "Article 21.1", "Article 21.2", "Article 21.3", "Article 21.4", "Article 21.5", "Article 21.6" ], "Americas Canada PIPEDA 2000": [ "P2-4.2.5", "P3-4.3", "P3-4.3.1", "P3-4.3.2", "P3-4.3.3", "P3-4.3.4", "P3-4.3.5", "P3-4.3.6", "P3-4.3.7", "P3-4.3.7(a)", "P3-4.3.7(b)", "P3-4.3.7(c)", "P3-4.3.7(d)" ] } }, { "principle_name": "Clear Choices", "description": "Provide clear and conspicuous choices that enable an individual, or a person authorized by the individual, to permit or prohibit the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data. This is also referred to as the right to \"opt out.\"", "scf_control": "Data Subject Consent", "scf_control_id": "PRI-24", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF1", "C3.1", "C3.1-POF1", "C3.1-POF3", "C3.2", "C3.2-POF2", "C3.2-POF3", "C3.2-POF4" ], "APEC Privacy Framework 2015": [ "2(e)", "4(a)", "5" ], "ISO 29100 2024": [ "6.2" ], "NIST 800-53 R5.2": [ "PT-04" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P3" ], "OECD Privacy Principles": [ "1", "4(a)" ], "USA Federal Data Privacy Framework 2023": [ "II.2.a", "II.2.c" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.506(b)(1)", "§ 164.508(a)(2)", "§ 164.508(c)(1)(v)", "§ 164.508(c)(3)", "§ 164.510(b)(2)(i)", "§ 164.510(b)(2)(ii)", "§ 164.510(b)(2)(iii)", "§ 164.510(b)(3)", "§ 164.514(f)(2)(ii)", "§ 164.514(f)(2)(iv)", "§ 164.514(f)(2)(v)" ], "USA California CCPA 2025": [ "7002(e)", "7010(b)", "7012(a)", "7012(b)", "7012(c)", "7012(d)", "7012(e)", "7012(e)(1)", "7012(e)(2)", "7012(e)(3)", "7012(e)(4)", "7012(e)(5)", "7012(e)(6)", "7027(c)", "7027(d)" ], "USA Illinois BIPA 2008": [ "15(b)(3)", "15(d)", "15(d)(1)", "15(d)(2)", "15(d)(3)", "15(d)(4)" ], "USA Montana CDPA 2025": [ "30-14-2811(3)(a)", "30-14-2811(3)(b)(i)", "30-14-2812(2)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.500.2(a)", "603A.500.2(b)", "603A.500.3", "603A.500.3(a)", "603A.500.3(b)", "603A.500.3(c)", "603A.500.3(d)", "603A.535.5", "603A.535.6", "603A.535.6(a)", "603A.535.6(b)", "603A.535.6(c)", "603A.535.6(d)", "603A.535.7" ], "USA Oregon CPA 2023": [ "Section 5(2)(b)", "Section 5(2)(c)" ], "USA Oregon 646A 2025": [ "646A.578(6)", "646A.583(1)(a)(C)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(E)", "47-18-3203(b)", "47-18-3204(a)(6)" ], "USA Texas CDPA 2025": [ "541.101(b)(4)", "541.107(a)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.5", "59.1-578.D" ], "EMEA EU GDPR 2016": [ "Article 7.1", "Article 7.2", "Article 9.2(a)", "Article 21.1", "Article 21.2", "Article 21.3", "Article 21.4", "Article 21.5", "Article 21.6" ], "Americas Canada PIPEDA 2000": [ "P2-4.2.5", "P3-4.3", "P3-4.3.1", "P3-4.3.2", "P3-4.3.3", "P3-4.3.4", "P3-4.3.5", "P3-4.3.6", "P3-4.3.7", "P3-4.3.7(a)", "P3-4.3.7(b)", "P3-4.3.7(c)", "P3-4.3.7(d)" ] } }, { "principle_name": "Initial Consent", "description": "Prior to the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data, the knowledge and consent of the individual are required.", "scf_control": "Data Subject Consent", "scf_control_id": "PRI-24", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF1", "C3.1", "C3.1-POF1", "C3.1-POF3", "C3.2", "C3.2-POF2", "C3.2-POF3", "C3.2-POF4" ], "APEC Privacy Framework 2015": [ "2(e)", "4(a)", "5" ], "ISO 29100 2024": [ "6.2" ], "NIST 800-53 R5.2": [ "PT-04" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P3" ], "OECD Privacy Principles": [ "1", "4(a)" ], "USA Federal Data Privacy Framework 2023": [ "II.2.a", "II.2.c" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.506(b)(1)", "§ 164.508(a)(2)", "§ 164.508(c)(1)(v)", "§ 164.508(c)(3)", "§ 164.510(b)(2)(i)", "§ 164.510(b)(2)(ii)", "§ 164.510(b)(2)(iii)", "§ 164.510(b)(3)", "§ 164.514(f)(2)(ii)", "§ 164.514(f)(2)(iv)", "§ 164.514(f)(2)(v)" ], "USA California CCPA 2025": [ "7002(e)", "7010(b)", "7012(a)", "7012(b)", "7012(c)", "7012(d)", "7012(e)", "7012(e)(1)", "7012(e)(2)", "7012(e)(3)", "7012(e)(4)", "7012(e)(5)", "7012(e)(6)", "7027(c)", "7027(d)" ], "USA Illinois BIPA 2008": [ "15(b)(3)", "15(d)", "15(d)(1)", "15(d)(2)", "15(d)(3)", "15(d)(4)" ], "USA Montana CDPA 2025": [ "30-14-2811(3)(a)", "30-14-2811(3)(b)(i)", "30-14-2812(2)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.500.2(a)", "603A.500.2(b)", "603A.500.3", "603A.500.3(a)", "603A.500.3(b)", "603A.500.3(c)", "603A.500.3(d)", "603A.535.5", "603A.535.6", "603A.535.6(a)", "603A.535.6(b)", "603A.535.6(c)", "603A.535.6(d)", "603A.535.7" ], "USA Oregon CPA 2023": [ "Section 5(2)(b)", "Section 5(2)(c)" ], "USA Oregon 646A 2025": [ "646A.578(6)", "646A.583(1)(a)(C)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(E)", "47-18-3203(b)", "47-18-3204(a)(6)" ], "USA Texas CDPA 2025": [ "541.101(b)(4)", "541.107(a)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.5", "59.1-578.D" ], "EMEA EU GDPR 2016": [ "Article 7.1", "Article 7.2", "Article 9.2(a)", "Article 21.1", "Article 21.2", "Article 21.3", "Article 21.4", "Article 21.5", "Article 21.6" ], "Americas Canada PIPEDA 2000": [ "P2-4.2.5", "P3-4.3", "P3-4.3.1", "P3-4.3.2", "P3-4.3.3", "P3-4.3.4", "P3-4.3.5", "P3-4.3.6", "P3-4.3.7", "P3-4.3.7(a)", "P3-4.3.7(b)", "P3-4.3.7(c)", "P3-4.3.7(d)" ] } }, { "principle_name": "Initial Consent", "description": "Prior to the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data, the knowledge and consent of the individual are required.", "scf_control": "Data Subject Opt-In Consent", "scf_control_id": "PRI-27", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "C3.2-POF2", "C3.2-POF3" ], "USA Federal Data Privacy Framework 2023": [ "III.1.a" ], "USA California CCPA 2025": [ "7028(a)", "7028(b)", "7028(c)" ], "USA Virginia CDPA 2023": [ "59.1-578.F.1", "59.1-578.F.1.b" ], "EMEA EU GDPR 2016": [ "Article 6.1(a)" ] } }, { "principle_name": "Updated Consent", "description": "Based on changes to data privacy practices that affect the parameters of an individual's initial consent, updated consent of the individual is required to continue the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data. This is also referred to as the right to revoke or \"opt out\" at any time after the initial consent was provided.", "scf_control": "Revoke Consent", "scf_control_id": "PRI-24.3", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF5" ], "NIST 800-53 R5.2": [ "PT-04(03)" ], "USA Montana CDPA 2025": [ "30-14-2812(1)(c)" ], "USA Nevada Privacy Law 2023": [ "603A.500.3(d)", "603A.505.1(c)", "603A.535.4" ], "USA Oregon CPA 2023": [ "Section 5(1)(d)" ], "USA Oregon 646A 2025": [ "646A.576(7)", "646A.578(1)(d)" ], "EMEA EU GDPR 2016": [ "Article 7.3" ], "EMEA UK DPA 2018": [ "Section 47(4)" ], "Americas Canada PIPEDA 2000": [ "P3-4.3.8" ] } }, { "principle_name": "Updated Consent", "description": "Based on changes to data privacy practices that affect the parameters of an individual's initial consent, updated consent of the individual is required to continue the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data. This is also referred to as the right to revoke or \"opt out\" at any time after the initial consent was provided.", "scf_control": "Just-In-Time Notice & Updated Consent", "scf_control_id": "PRI-24.4", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF1", "N2.1-POF2", "N2.2", "C3.2-POF1" ], "NIST 800-53 R5.2": [ "PT-04(02)", "PT-05(01)" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P3" ], "USA Federal Data Privacy Framework 2023": [ "III.14.b.i", "III.14.b.ii" ], "USA California CCPA 2025": [ "7002(f)", "7010(f)", "7022(g)", "7022(h)", "7025(c)(5)", "7026(k)", "7027(l)", "7221(i)", "7221(k)" ], "USA Montana CDPA 2025": [ "30-14-2812(8)" ], "Americas Canada PIPEDA 2000": [ "P2-4.2.4" ] } }, { "principle_name": "Equal Service & Price", "description": "Implement business processes to protect the right of data subjects to equal service and price, even if they exercise their data privacy rights.", "scf_control": "Statutory, Regulatory & Contractual Compliance", "scf_control_id": "CPL-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF9" ], "ISO 27701 2025": [ "4.1", "4.2(a)", "4.2(b)", "4.2(c)" ], "ISO 29100 2024": [ "6.12" ], "NIST 800-53 R5.2": [ "PL-01", "PM-08" ], "NIST CSF 2.0": [ "GV.OC", "GV.OC-03", "GV.SC-05", "PR" ], "NIST Privacy Framework 1.0": [ "GV.PO-P5" ], "USA Federal Data Privacy Framework 2023": [ "II.7.c", "III.5.a", "III.5.b.i" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(c)", "§ 164.306(d)(1)", "§ 164.306(d)(2)", "§ 164.314(a)(1)", "§ 164.314(a)(2)(ii)", "§ 164.504(g)(1)", "§ 164.530(i)(1)" ], "USA California CCPA 2025": [ "7013(h)", "7022(d)", "7023(e)", "7050(b)", "7072(b)", "7123(b)(3)", "7200(a)", "7200(b)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(1)", "6-1-1305(2)", "6-1-1305(2)(b)", "6-1-1305(2)(c)", "6-1-1308(6)" ], "USA Illinois IPA 2009": [ "15", "25", "35(a)(1)", "37(a)(1)" ], "USA Montana CDPA 2025": [ "30-14-2812(2)(c)" ], "USA Nevada Privacy Law 2023": [ "603A.500.2(c)", "603A.525.2(b)" ], "USA Oregon CPA 2023": [ "Section 7(1)(b)" ], "USA Texas CDPA 2025": [ "541.101(b)(2)" ], "USA Virginia CDPA 2023": [ "59.1-581.E" ], "USA Vermont Act 171 2018": [ "2446(a)(2)", "2446(a)(3)", "2446(a)(3)(A)", "2446(a)(3)(B)", "2446(a)(3)(B)(i)", "2446(a)(3)(B)(ii)", "2446(a)(3)(B)(iii)", "2446(a)(3)(C)", "2446(a)(3)(D)", "2446(a)(3)(E)", "2446(a)(3)(F)", "2446(a)(3)(G)" ], "APAC Australian Privacy Principles 2026": [ "1.1.2.a" ], "APAC New Zealand Privacy Act of 2020": [ "6.2.126(1)", "6.2.126(2)", "6.2.126(2)(a)", "6.2.126(2)(b)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1", "P1-4.1.3" ] } }, { "principle_name": "Equal Service & Price", "description": "Implement business processes to protect the right of data subjects to equal service and price, even if they exercise their data privacy rights.", "scf_control": "Product or Service Delivery Restrictions", "scf_control_id": "PRI-13", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "C3.1-POF2", "C3.1-POF3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.508(c)(2)(ii)(A)", "§ 164.508(c)(2)(ii)(B)", "§ 164.514(f)(2)(iii)" ], "USA California CCPA 2025": [ "7080(a)", "7080(b)", "7221(l)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(c)(I)", "6-1-1308(1)(c)(II)" ], "USA Montana CDPA 2025": [ "30-14-2812(2)(e)" ], "USA Nevada Privacy Law 2023": [ "603A.535.2" ], "USA Oregon CPA 2023": [ "Section 5(2)(d)" ], "USA Texas CDPA 2025": [ "541.101(b)(3)", "541.101(c)" ], "USA Virginia CDPA 2023": [ "59.1-577.1.E", "59.1-578.A.4" ] } }, { "principle_name": "Prohibit The Sale of Personal Data", "description": "Provide a clear and conspicuous link on the organization's Internet-based homepage, titled “Do Not Sell My Personal Data” that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal data.", "scf_control": "Tailored Consent", "scf_control_id": "PRI-24.2", "crosswalks": { "NIST 800-53 R5.2": [ "PT-04(01)" ], "NIST Privacy Framework 1.0": [ "CT.PO-P3" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(e)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(E)(i)", "47-18-3203(a)(2)(E)(ii)", "47-18-3203(a)(2)(E)(iii)", "47-18-3203(b)" ] } }, { "principle_name": "Prohibit The Sale of Personal Data", "description": "Provide a clear and conspicuous link on the organization's Internet-based homepage, titled “Do Not Sell My Personal Data” that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal data.", "scf_control": "Prohibition of Selling, Processing and/or Sharing Personal Data (PD)", "scf_control_id": "PRI-24.5", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)(5)(ii)(A)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(b)" ], "USA Illinois BIPA 2008": [ "15(c)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(e)", "30-14-2811(2)(a)(i)", "30-14-2812(2)(d)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(E)(i)", "47-18-3203(a)(2)(E)(ii)", "47-18-3203(a)(2)(E)(iii)", "47-18-3204(d)" ], "USA Texas CDPA 2025": [ "541.101(b)(4)" ], "USA Virginia CDPA 2023": [ "59.1-577.1.C", "59.1-578.F.1", "59.1-578.F.1.a" ] } }, { "principle_name": "Authorized Agent (Proxy)", "description": "Allow data subjects to authorize another person or entity, acting on the data subject's behalf, to make Personal Data (PD) processing decisions.", "scf_control": "Authorized Agent", "scf_control_id": "PRI-28", "crosswalks": { "USA Federal Data Privacy Framework 2023": [ "II.2.b" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(g)(1)", "§ 164.502(g)(2)", "§ 164.502(g)(3)(i)", "§ 164.502(g)(3)(i)(A)" ], "USA California CCPA 2025": [ "7026(j)", "7027(j)", "7063(a)", "7063(a)(1)", "7063(a)(2)", "7063(b)", "7063(c)", "7063(d)", "7221(j)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)(a)(II)" ], "USA Montana CDPA 2025": [ "30-14-2808(3)(a)", "30-14-2808(3)(c)", "30-14-2809(1)", "30-14-2809(2)" ], "USA Oregon CPA 2023": [ "Section 4(4)" ], "USA Oregon 646A 2025": [ "646A.576(3)", "646A.576(4)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(1)" ], "USA Texas CDPA 2025": [ "541.055(e)", "541.055(e)(1)", "541.055(e)(2)", "541.055(e)(3)", "541.055(e)(4)" ], "USA Virginia CDPA 2023": [ "59.1-577.A", "59.1-577.1.D", "59.1-578.A.5", "59.1-578.F.3" ], "EMEA EU GDPR 2016": [ "Article 8.1", "Article 8.2" ] } }, { "principle_name": "Global Privacy Control (GPC)", "description": "Enable automated mechanisms to provide data subjects with functionality to automatically exercise pre-selected opt-out preferences (e.g., opt-out signal).", "scf_control": "Global Privacy Control (GPC)", "scf_control_id": "PRI-26.3", "crosswalks": { "USA California CCPA 2025": [ "7025(a)", "7025(b)", "7025(b)(1)", "7025(b)(2)", "7025(c)", "7025(c)(1)", "7025(c)(2)", "7025(c)(3)", "7025(c)(5)", "7025(c)(6)", "7025(d)", "7025(e)", "7025(f)", "7025(f)(1)", "7025(f)(2)", "7025(f)(3)", "7025(g)", "7025(g)(1)", "7025(g)(3)" ], "USA Montana CDPA 2025": [ "30-14-2809(1)", "30-14-2809(3)(b)", "30-14-2809(4)(a)" ], "USA Oregon CPA 2023": [ "Section 5(5)(c)", "Section 5(5)(c)(A)", "Section 5(5)(c)(B)", "Section 5(5)(c)(C)", "Section 5(5)(c)(D)", "Section 5(5)(c)(E)" ], "USA Oregon 646A 2025": [ "646A.578(5)(c)", "646A.578(5)(c)(A)", "646A.578(5)(c)(B)", "646A.578(5)(c)(C)", "646A.578(5)(c)(D)", "646A.578(5)(c)(E)" ] } }, { "principle_name": "Limited Collection & Use", "description": "Ensure that the design of data collection and use are consistent with the intended use of the information and the need for new information is balanced against any data privacy risks.", "scf_control": "Restrict Collection, Processing & Sharing To Identified Purpose", "scf_control_id": "PRI-31.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF2", "C3.1-POF4" ], "APEC Privacy Framework 2015": [ "3" ], "ISO 29100 2024": [ "6.4", "6.5" ], "NIST 800-53 R5.2": [ "PT-02" ], "USA Federal Data Privacy Framework 2023": [ "II.5.a" ], "USA Federal FIPPS 1973": [ "4" ], "USA California CCPA 2025": [ "7002(f)" ], "USA Illinois IPA 2009": [ "10(b)(1)" ], "USA Montana CDPA 2025": [ "30-14-2811(2)(a)(ii)", "30-14-2811(2)(c)", "30-14-2812(1)(a)", "30-14-2812(2)(a)", "30-14-2816(6)" ], "USA Nevada Privacy Law 2023": [ "603A.495.3(a)", "603A.495.3(c)", "603A.500.1(a)", "603A.500.1(b)", "603A.535.1", "603A.535.1(a)", "603A.535.1(b)" ], "USA Oregon CPA 2023": [ "Section 5(1)(b)", "Section 5(2)(b)" ], "USA Oregon 646A 2025": [ "646A.578(1)(b)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(1)", "47-18-3204(a)(2)" ], "USA Texas CDPA 2025": [ "541.101(a)(1)", "541.101(b)(1)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.1", "59.1-578.F.1", "59.1-578.F.1.c", "59.1-578.F.2" ], "USA Vermont Act 171 2018": [ "2433(a)(1)" ], "EMEA EU GDPR 2016": [ "Article 5.1(b)", "Article 5.1(c)", "Article 8.1" ], "Americas Canada PIPEDA 2000": [ "P4-4.4" ] } }, { "principle_name": "Authority to Collect", "description": "Identify the lawful basis given to collect, create, use, disseminate, maintain, and/or disclose an individual’s personal data. Document this authority in the organization's publicly-facing data privacy notice.", "scf_control": "Authority To Collect, Process, Store & Share Personal Data (PD)", "scf_control_id": "PRI-12", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF2" ], "APEC Privacy Framework 2015": [ "4(c)" ], "ISO 29100 2024": [ "6.3" ], "NIST 800-53 R5.2": [ "PT-02" ], "OECD Privacy Principles": [ "1", "4(b)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)(1)(i)", "§ 164.502(a)(1)(ii)", "§ 164.502(a)(1)(iii)", "§ 164.502(a)(5)(i)", "§ 164.502(i)" ], "USA Federal FIPPS 1973": [ "3" ], "USA Alaska PIPA 2029": [ "45.48.400 - .480", "45.48.410", "45.48.410.1", "45.48.410.2", "45.48.410.3", "45.48.410.4", "45.48.410.5", "45.48.410.6", "45.48.410.7", "45.48.410.8", "45.48.420", "45.48.420.1", "45.48.420.2", "45.48.420.3", "45.48.420.4" ], "USA Illinois IPA 2009": [ "10(b)(1)" ], "USA Oregon CPA 2023": [ "Section 5(2)(b)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(5)", "47-18-3204(b)" ], "USA Virginia CDPA 2023": [ "59.1-578.F.1.b", "59.1-578.F.1.c" ], "EMEA EU GDPR 2016": [ "Article 9.2(b)", "Article 9.2(c)", "Article 9.2(d)", "Article 9.2(e)", "Article 9.2(f)", "Article 9.2(g)", "Article 9.2(h)", "Article 9.2(i)", "Article 9.2(j)", "Article 9.3", "Article 10" ], "EMEA UK DPA 2018": [ "Section 44(2)(a)" ], "APAC Australian Privacy Principles 2026": [ "2.3.1", "2.3.2" ], "Americas Canada PIPEDA 2000": [ "P4-4.4" ] } }, { "principle_name": "Data Minimization", "description": "Take steps to minimize the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the individual’s personal data to what is directly relevant and necessary to accomplish a legally authorized purpose.", "scf_control": "Limit Sensitive / Regulated Data In Testing, Training & Research", "scf_control_id": "DCH-28", "crosswalks": { "NIST 800-53 R5.2": [ "PM-25", "SA-08(33)", "SA-15(12)", "SI-12(02)" ] } }, { "principle_name": "Internal Use", "description": "Restrict the internal use of personal data to only authorized purpose(s) that are consistent with the stated data privacy notice.", "scf_control": "Minimize Sensitive / Regulated Data Exposure", "scf_control_id": "DCH-27.1", "crosswalks": { "ISO 29100 2024": [ "6.5" ], "NIST 800-53 R5.2": [ "SI-12(01)" ], "NIST Privacy Framework 1.0": [ "CT.DM-P8" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(b)(1)" ] } }, { "principle_name": "Internal Use", "description": "Restrict the internal use of personal data to only authorized purpose(s) that are consistent with the stated data privacy notice.", "scf_control": "Usage Restrictions of Personal Data (PD)", "scf_control_id": "PRI-29", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF3", "U4.1", "U4.1-POF1", "Q8.1-POF3" ], "ISO 29100 2024": [ "6.6" ], "NIST 800-53 R5.2": [ "AC-23", "PM-25", "PT-02", "PT-07" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P2" ], "OECD Privacy Principles": [ "4" ], "USA Federal Data Privacy Framework 2023": [ "II.2.c" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(c)", "§ 164.502(d)(1)", "§ 164.504(g)(2)", "§ 164.506(a)", "§ 164.506(c)(1)", "§ 164.506(c)(5)", "§ 164.508(a)(1)", "§ 164.508(a)(2)(i)(C)", "§ 164.510(a)(1)(i)(A)", "§ 164.510(a)(1)(i)(B)", "§ 164.510(a)(1)(i)(C)", "§ 164.510(a)(1)(i)(D)", "§ 164.510(a)(1)(ii)(A)", "§ 164.510(a)(1)(ii)(B)", "§ 164.510(b)(4)", "§ 164.512", "§ 164.512(i)(1)", "§ 164.512(j)(1)", "§ 164.512(j)(1)(i)(A)", "§ 164.512(j)(1)(i)(B)", "§ 164.512(j)(1)(ii)", "§ 164.512(j)(1)(ii)(A)", "§ 164.512(j)(1)(ii)(B)", "§ 164.512(j)(2)(i)", "§ 164.512(j)(2)(ii)", "§ 164.512(j)(3)", "§ 164.512(j)(4)", "§ 164.512(k)(1)(i)", "§ 164.512(k)(1)(i)(A)", "§ 164.512(k)(1)(i)(B)", "§ 164.512(k)(1)(ii)", "§ 164.512(k)(1)(iii)", "§ 164.512(k)(1)(iv)", "§ 164.512(k)(2)", "§ 164.512(k)(3)", "§ 164.512(k)(4)", "§ 164.512(k)(4)(i)", "§ 164.512(k)(4)(ii)", "§ 164.512(k)(4)(iii)", "§ 164.512(k)(5)(i)", "§ 164.512(k)(5)(i)(A)", "§ 164.512(k)(5)(i)(B)", "§ 164.512(k)(5)(i)(C)", "§ 164.512(k)(5)(i)(D)", "§ 164.512(k)(5)(i)(E)", "§ 164.512(k)(5)(i)(F)", "§ 164.512(k)(5)(ii)", "§ 164.512(k)(5)(iii)", "§ 164.512(k)(6)(i)", "§ 164.512(k)(6)(ii)", "§ 164.512(k)(6)(ii)(1)", "§ 164.514(f)(2)(i)", "§ 164.514(g)", "§ 164.530(i)(4)(ii)", "§ 164.530(i)(4)(ii)(B)", "§ 164.532(a)", "§ 164.532(b)", "§ 164.532(c)" ], "USA Federal FIPPS 1973": [ "4" ], "USA California CCPA 2025": [ "7023(d)(3)", "7026(f)", "7026(f)(1)", "7027(a)" ], "USA Montana CDPA 2025": [ "30-14-2808(4)(e)", "30-14-2811(2)(a)(ii)", "30-14-2812(2)(a)" ], "USA Nevada SB220 2019": [ "2.3" ], "USA Oregon CPA 2023": [ "Section 4(7)(b)", "Section 5(2)(a)", "Section 5(2)(c)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(C)(i)(b)", "47-18-3203(a)(2)(C)(ii)", "47-18-3204(a)(6)", "47-18-3207(b)", "47-18-3207(c)", "47-18-3207(d)" ], "USA Texas BC521 2009": [ "521.051(a)" ], "USA Texas CDPA 2025": [ "541.052(f)(2)", "541.204(a)", "541.204(a)(1)", "541.204(a)(2)", "541.204(b)" ], "USA Virginia CDPA 2023": [ "59.1-577.1.C", "59.1-578.A.2", "59.1-578.F.1.c" ], "EMEA UK DPA 2018": [ "Section 44(4)", "Section 44(4)(a)", "Section 44(4)(b)", "Section 44(4)(c)", "Section 44(4)(e)", "Section 47(4)" ], "APAC Australian Privacy Principles 2026": [ "2.3.3", "2.3.3.a", "2.3.3.a.i", "2.3.3.a.ii", "2.3.3.b", "2.3.4", "2.3.4.a", "2.3.4.b", "2.3.4.c", "2.3.4.d", "2.3.4.d.i", "2.3.4.d.ii", "2.3.4.e", "2.3.4.e.i", "2.3.4.e.ii", "3.6.1", "3.6.1.a", "3.6.1.b", "3.6.2", "3.6.2.a", "3.6.2.a.i", "3.6.2.a.ii", "3.6.2.b", "3.6.2.c", "3.6.2.d", "3.6.2.e", "3.6.3", "3.6.4", "3.6.4.a", "3.6.4.b", "3.7.1", "3.7.2", "3.7.2.a", "3.7.2.b", "3.7.2.c", "3.7.2.d", "3.7.3", "3.7.3.a", "3.7.3.a.i", "3.7.3.a.ii", "3.7.3.b", "3.7.3.b.i", "3.7.3.b.ii", "3.7.3.c", "3.7.3.d", "3.7.3.d.i", "3.7.3.d.ii", "3.7.3.e", "3.7.4", "3.7.5", "3.7.5.a", "3.7.5.b", "3.7.5.c" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.1(1)", "3.1.22.1(1)(a)", "3.1.22.1(1)(b)", "3.1.22.10(1)", "3.1.22.10(1)(a)", "3.1.22.10(1)(b)", "3.1.22.10(1)(b)(i)", "3.1.22.10(1)(b)(ii)", "3.1.22.10(1)(c)", "3.1.22.10(1)(d)", "3.1.22.10(1)(e)", "3.1.22.10(1)(e)(i)", "3.1.22.10(1)(e)(ii)", "3.1.22.10(1)(e)(iii)", "3.1.22.10(1)(e)(iv)", "3.1.22.10(1)(f)", "3.1.22.10(1)(f)(i)", "3.1.22.10(1)(f)(ii)" ], "Americas Canada PIPEDA 2000": [ "P5-4.5", "P5-4.5.3" ] } }, { "principle_name": "Internal Use", "description": "Restrict the internal use of personal data to only authorized purpose(s) that are consistent with the stated data privacy notice.", "scf_control": "Internal Use of Personal Data (PD) For Testing, Training and Research", "scf_control_id": "PRI-29.3", "crosswalks": { "NIST 800-53 R5.2": [ "PM-25", "PT-02", "PT-03", "SI-12(01)", "SI-12(02)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.508(a)(2)(i)(B)" ], "USA Oregon CPA 2023": [ "Section 7(1)(c)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(2)", "47-18-3207(a)(1)", "47-18-3207(a)(2)", "47-18-3207(a)(3)", "47-18-3207(b)(1)", "47-18-3207(b)(2)", "47-18-3207(b)(3)", "47-18-3207(b)(3)(A)", "47-18-3207(b)(3)(B)", "47-18-3207(b)(3)(C)" ] } }, { "principle_name": "Transparency", "description": "Provide a transparent notice to the public about data privacy practices through a clear and conspicuous notice on all organizational websites, mobile applications and other digital services regarding the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the personal data.", "scf_control": "Notification of Disclosure Requests To Data Subject", "scf_control_id": "PRI-18", "crosswalks": {} }, { "principle_name": "Transparency", "description": "Provide a transparent notice to the public about data privacy practices through a clear and conspicuous notice on all organizational websites, mobile applications and other digital services regarding the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the personal data.", "scf_control": "Privacy Act Statements", "scf_control_id": "PRI-20.1", "crosswalks": { "NIST 800-53 R5.2": [ "PT-05(02)" ], "NIST Privacy Framework 1.0": [ "CM.PO-P1" ] } }, { "principle_name": "Transparency", "description": "Provide a transparent notice to the public about data privacy practices through a clear and conspicuous notice on all organizational websites, mobile applications and other digital services regarding the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of the personal data.", "scf_control": "Data Privacy Notice", "scf_control_id": "PRI-21", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF1", "N2.1", "N2.1-POF2", "N2.1-POF3", "N2.1-POF4", "N2.2", "C3.1-POF3", "M9.1-POF1" ], "APEC Privacy Framework 2015": [ "2", "2(a)", "2(b)", "2(c)", "2(d)", "2(e)" ], "ISO 29100 2024": [ "6.3" ], "NIST 800-53 R5.2": [ "PM-20(01)", "PT-05" ], "NIST Privacy Framework 1.0": [ "CM.PO-P1", "CM.AW-P1" ], "USA Federal Data Privacy Framework 2023": [ "II.1.a.i", "II.1.a.ii", "II.1.a.iii", "II.1.a.iv", "II.1.a.v", "II.1.a.vi", "II.1.a.vii", "II.1.a.viii", "II.1.a.ix", "II.1.a.x", "II.1.a.xi", "II.1.a.xii", "II.1.a.xiii", "II.1.b", "III.11.d.i", "III.11.d.ii", "III.14.b.ii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.520(a)(1)", "§ 164.520(a)(2)(i)", "§ 164.520(a)(2)(i)(A)", "§ 164.520(a)(2)(i)(B)", "§ 164.520(a)(2)(ii)", "§ 164.520(a)(2)(ii)(A)", "§ 164.520(a)(2)(ii)(B)", "§ 164.520(a)(2)(iii)", "§ 164.520(b)(1)", "§ 164.520(b)(1)(i)", "§ 164.520(b)(1)(ii)", "§ 164.520(b)(1)(ii)(A)", "§ 164.520(b)(1)(ii)(B)", "§ 164.520(b)(1)(ii)(C)", "§ 164.520(b)(1)(ii)(D)", "§ 164.520(b)(1)(ii)(E)", "§ 164.520(b)(1)(iv)", "§ 164.520(b)(1)(iv)(A)", "§ 164.520(b)(1)(iv)(B)", "§ 164.520(b)(1)(iv)(C)", "§ 164.520(b)(1)(iv)(D)", "§ 164.520(b)(1)(iv)(E)", "§ 164.520(b)(1)(iv)(F)", "§ 164.520(b)(1)(v)", "§ 164.520(b)(1)(v)(A)", "§ 164.520(b)(1)(v)(B)", "§ 164.520(b)(1)(v)(C)", "§ 164.520(b)(1)(vi)", "§ 164.520(b)(1)(vii)", "§ 164.520(b)(1)(viii)", "§ 164.520(b)(2)(i)", "§ 164.520(b)(2)(ii)", "§ 164.520(b)(3)", "§ 164.520(c)", "§ 164.520(c)(1)(i)", "§ 164.520(c)(1)(i)(A)", "§ 164.520(c)(1)(i)(B)", "§ 164.520(c)(1)(ii)", "§ 164.520(c)(1)(iii)", "§ 164.520(c)(1)(iv)", "§ 164.520(c)(1)(v)", "§ 164.520(c)(1)(v)(A)", "§ 164.520(c)(1)(v)(B)", "§ 164.530(i)(4)(i)(C)" ], "USA Federal FIPPS 1973": [ "7", "8" ], "USA California CCPA 2025": [ "7002(b)(5)", "7003(a)", "7004(a)(1)", "7010(a)", "7011(a)", "7011(b)", "7011(c)", "7011(d)", "7011(e)", "7011(e)(1)", "7011(e)(1)(A)", "7011(e)(1)(B)", "7011(e)(1)(C)", "7011(e)(1)(D)", "7011(e)(1)(E)", "7011(e)(1)(F)", "7011(e)(1)(G)", "7011(e)(1)(H)", "7011(e)(1)(I)", "7011(e)(1)(J)", "7011(e)(2)", "7011(e)(2)(A)", "7011(e)(2)(B)", "7011(e)(2)(C)", "7011(e)(2)(D)", "7011(e)(2)(E)", "7011(e)(2)(F)", "7011(e)(2)(G)", "7011(e)(2)(H)", "7011(e)(3)", "7011(e)(3)(A)", "7011(e)(3)(B)", "7011(e)(3)(C)", "7011(e)(3)(D)", "7011(e)(3)(E)", "7011(e)(3)(F)", "7011(e)(3)(G)", "7011(e)(3)(H)", "7011(e)(3)(I)", "7011(e)(3)(J)", "7011(e)(4)", "7011(e)(5)", "7012(f)", "7012(g)(1)", "7013(c)", "7013(e)", "7013(e)(1)", "7013(e)(2)", "7013(e)(3)", "7013(g)(2)", "7014(b)", "7014(c)", "7014(d)", "7014(e)(1)", "7014(e)(2)", "7014(e)(3)", "7014(g)(1)", "7014(g)(2)", "7014(h)", "7025(g)(2)", "7025(g)(2)(A)", "7025(g)(2)(B)", "7025(g)(2)(C)", "7025(g)(2)(D)", "7072(a)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(a)", "6-1-1308(1)(a)(III)", "6-1-1308(1)(a)(IV)", "6-1-1308(1)(a)(V)", "6-1-1308(1)(b)", "6-1-1308(2)" ], "USA Illinois BIPA 2008": [ "15(a)", "15(b)(1)", "15(b)(2)" ], "USA Illinois IPA 2009": [ "35(a)(5)", "37(a)(5)" ], "USA Montana CDPA 2025": [ "30-14-2808(2)", "30-14-2812(4)", "30-14-2812(5)", "30-14-2812(5)(c)", "30-14-2812(5)(d)", "30-14-2812(5)(e)", "30-14-2812(5)(f)", "30-14-2812(5)(g)", "30-14-2812(8)", "30-14-2815(1)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.340.1", "603A.340.1(b)", "603A.340.1(c)", "603A.340.1(d)", "603A.340.1(e)", "603A.345.1", "603A.346.1", "603A.495.1", "603A.495.1(a)", "603A.495.1(b)", "603A.495.1(c)", "603A.495.1(d)", "603A.495.1(e)", "603A.495.1(f)", "603A.495.1(g)", "603A.495.1(h)", "603A.495.1(i)", "603A.495.1(j)", "603A.495.1(k)", "603A.495.2" ], "USA Oregon CPA 2023": [ "Section 5(1)(a)", "Section 5(4)(a)", "Section 5(4)(b)", "Section 5(4)(c)", "Section 5(4)(d)", "Section 5(4)(e)", "Section 5(4)(f)", "Section 5(4)(g)", "Section 5(4)(h)", "Section 5(4)(i)" ], "USA Oregon 646A 2025": [ "646A.578(1)(a)", "646A.578(4)", "646A.578(4)(a)", "646A.578(4)(b)", "646A.578(4)(c)", "646A.578(4)(d)", "646A.578(4)(e)", "646A.578(4)(f)", "646A.578(4)(g)", "646A.578(4)(h)", "646A.578(4)(i)", "646A.578(5)(b)", "646A.583(1)(a)(B)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(1)", "47-18-3204(c)", "47-18-3204(c)(1)", "47-18-3204(c)(2)", "47-18-3204(c)(3)", "47-18-3204(c)(4)", "47-18-3204(c)(5)", "47-18-3204(d)", "47-18-3204(e)(1)" ], "USA Texas CDPA 2025": [ "541.053(b)", "541.055(c)", "541.055(d)", "541.102(a)(1)", "541.102(a)(2)", "541.102(a)(3)", "541.102(a)(4)", "541.102(a)(5)", "541.102(a)(6)", "541.102(b)", "541.103", "541.106(a)(2)" ], "USA Virginia CDPA 2023": [ "59.1-578.C", "59.1-578.C.1", "59.1-578.C.2", "59.1-578.C.3", "59.1-578.C.4", "59.1-578.C.5", "59.1-578.D", "59.1-578.E", "59.1-581.A.2" ], "EMEA EU GDPR 2016": [ "Article 12.7", "Article 13.1(a)", "Article 13.1(b)", "Article 13.1(c)", "Article 13.1(d)", "Article 13.1(e)", "Article 13.2", "Article 13.2(a)", "Article 13.2(b)", "Article 13.2(c)", "Article 13.2(d)", "Article 13.2(e)", "Article 13.2(f)", "Article 13.3", "Article 14.1(a)", "Article 14.1(b)", "Article 14.1(c)", "Article 14.1(d)", "Article 14.1(e)", "Article 14.1(f)", "Article 14.2", "Article 14.2(a)", "Article 14.2(b)", "Article 14.2(c)", "Article 14.2(d)", "Article 14.2(e)", "Article 14.2(f)", "Article 14.2(g)", "Article 14.3(a)", "Article 14.3(b)", "Article 14.3(c)", "Article 14.4", "Article 14.5(a)" ], "EMEA UK DPA 2018": [ "Section 44(1)", "Section 44(1)(a)", "Section 44(1)(b)", "Section 44(1)(c)", "Section 44(1)(d)", "Section 44(1)(d)(i)", "Section 44(1)(d)(ii)", "Section 44(1)(d)(iii)", "Section 44(1)(e)", "Section 44(2)", "Section 44(2)(b)", "Section 44(2)(c)", "Section 44(2)(d)", "Section 44(3)", "Section 69(4)" ], "APAC Australian Privacy Principles 2026": [ "1.1.3", "1.1.4", "1.1.4.a", "1.1.4.b", "1.1.4.c", "1.1.4.d", "1.1.4.e", "1.1.4.f", "1.1.4.g", "1.1.5", "1.1.5.a", "1.1.5.b", "1.1.6", "2.5.1", "2.5.1.a", "2.5.1.b", "2.5.2", "2.5.2.a", "2.5.2.b", "2.5.2.b.i", "2.5.2.b.ii", "2.5.2.c", "2.5.2.d", "2.5.2.e", "2.5.2.f", "2.5.2.g", "2.5.2.h", "2.5.2.i", "2.5.2.j" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.3(1)", "3.1.22.3(1)(a)", "3.1.22.3(1)(b)", "3.1.22.3(1)(c)", "3.1.22.3(1)(d)", "3.1.22.3(1)(d)(i)", "3.1.22.3(1)(d)(ii)", "3.1.22.3(1)(e)", "3.1.22.3(1)(e)(i)", "3.1.22.3(1)(e)(ii)", "3.1.22.3(1)(f)", "3.1.22.3(1)(g)", "4.1.45(1)", "4.1.45(1)(a)", "4.1.45(1)(b)", "4.1.45(1)(c)", "4.1.45(2)" ], "Americas Canada PIPEDA 2000": [ "P2-4.2", "P2-4.2.1", "P2-4.2.2", "P2-4.2.3", "P8-4.8", "P8-4.8.1", "P8-4.8.2", "P8-4.8.2(a)", "P8-4.8.2(b)", "P8-4.8.2(c)", "P8-4.8.2(d)", "P8-4.8.2(e)", "P8-4.8.3" ] } }, { "principle_name": "Data Privacy Notice & Purpose Specification", "description": "Provide notice of the specific purpose(s) for which personal data is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Notification of Disclosure Requests To Data Subject", "scf_control_id": "PRI-18", "crosswalks": {} }, { "principle_name": "Data Privacy Notice & Purpose Specification", "description": "Provide notice of the specific purpose(s) for which personal data is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Purpose Specification", "scf_control_id": "PRI-22", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "C3.2-POF1" ], "ISO 29100 2024": [ "6.3" ], "NIST 800-53 R5.2": [ "PT-03" ], "NIST Privacy Framework 1.0": [ "CM.PO-P1" ], "OECD Privacy Principles": [ "3" ], "USA Federal Data Privacy Framework 2023": [ "II.1.a.iv", "II.5.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)(3)", "§ 164.508(c)(1)(i)", "§ 164.508(c)(1)(ii)", "§ 164.508(c)(1)(iii)", "§ 164.508(c)(1)(iv)", "§ 164.508(c)(2)(i)(A)", "§ 164.508(c)(2)(i)(B)" ], "USA Federal FIPPS 1973": [ "3", "7" ], "USA California CCPA 2025": [ "7002(a)(1)", "7002(a)(2)", "7002(b)(4)", "7027(m)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1308(1)(a)(II)" ], "USA Montana CDPA 2025": [ "30-14-2812(5)(b)" ], "USA Oregon CPA 2023": [ "Section 5(1)(a)", "Section 5(4)(b)", "Section 5(4)(h)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(c)(2)" ], "USA Texas CDPA 2025": [ "541.101(b)(1)", "541.102(a)(2)" ], "USA Virginia CDPA 2023": [ "59.1-578.C.2" ], "EMEA EU GDPR 2016": [ "Article 13.1(c)", "Article 14.1(c)" ], "Americas Canada PIPEDA 2000": [ "P2-4.2" ] } }, { "principle_name": "Data Lifecycle Management", "description": "Limit the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data to that which is legally authorized, relevant and deemed \"reasonably necessary\" for the proper performance of business functions.", "scf_control": "Data Protection", "scf_control_id": "DCH-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF4", "S7.4" ], "ISO 27701 2025": [ "7.5.3(b)" ], "NIST 800-53 R5.2": [ "MP-01" ], "NIST CSF 2.0": [ "ID.AM-08", "PR.DS", "PR.DS-01", "PR.DS-02", "PR.DS-10" ], "NIST Privacy Framework 1.0": [ "ID.IM-P", "GV.PO-P1", "CT.DM-P1", "CT.DM-P2", "CT.DM-P3", "CT.DM-P4", "PR.DS-P" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(3)", "§ 164.310(d)(1)", "§ 164.312(c)(1)", "§ 164.514(d)(3)(i)", "§ 164.530(c)(2)(i)" ], "USA Nevada Privacy Law 2023": [ "603A.200.1" ] } }, { "principle_name": "Data Lifecycle Management", "description": "Limit the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data to that which is legally authorized, relevant and deemed \"reasonably necessary\" for the proper performance of business functions.", "scf_control": "Personal Data (PD) Retention & Disposal", "scf_control_id": "PRI-30", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "U4.2", "U4.2-POF1", "U4.3", "U4.3-POF1", "U4.3-POF2", "U4.3-POF3" ], "ISO 29100 2024": [ "6.5", "6.6" ], "NIST 800-53 R5.2": [ "AC-04(25)", "SI-12", "SI-12(03)" ], "NIST CSF 2.0": [ "ID.AM-07" ], "USA Federal Data Privacy Framework 2023": [ "II.5.b" ], "USA Federal FIPPS 1973": [ "4" ], "USA Illinois BIPA 2008": [ "15(a)" ], "USA Montana CDPA 2025": [ "30-14-2808(4)(e)", "30-14-2811(2)(a)(iii)", "30-14-2811(2)(c)", "30-14-2813(2)(b)" ], "USA Oregon CPA 2023": [ "Section 4(7)(a)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(C)(i)(a)", "47-18-3204(a)(4)" ], "USA Texas BC521 2009": [ "521.052(b)", "521.052(b)(1)", "521.052(b)(2)", "521.052(b)(3)" ], "EMEA EU GDPR 2016": [ "Article 5.1(e)" ], "APAC Australian Privacy Principles 2026": [ "4.11.2", "4.11.2.a", "4.11.2.b", "4.11.2.c", "4.11.2.d" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.9" ], "Americas Canada PIPEDA 2000": [ "P5-4.5.3", "P7-4.7.5" ] } }, { "principle_name": "Data Lifecycle Management", "description": "Limit the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data to that which is legally authorized, relevant and deemed \"reasonably necessary\" for the proper performance of business functions.", "scf_control": "Automated Decision-Making Technology (ADMT)", "scf_control_id": "PRI-36", "crosswalks": { "NIST 800-53 R5.2": [ "PM-24", "PT-02(02)", "PT-03(02)" ], "EMEA UK DPA 2018": [ "Section 50B(1)", "Section 50B(2)", "Section 50B(3)", "Section 96(1)", "Section 96(2)", "Section 96(2)(a)", "Section 96(2)(b)", "Section 96(2)(c)", "Section 96(2)(c)(i)", "Section 96(2)(c)(ii)", "Section 96(2)(c)(iii)", "Section 96(3)", "Section 96(4)" ] } }, { "principle_name": "Processing Records", "description": "Maintain a record of processing activities that documents the organization's necessary records to support its obligations for the processing of sensitive/regulated data.", "scf_control": "Personal Data (PD) Lineage", "scf_control_id": "PRI-05.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04(12)" ], "NIST Privacy Framework 1.0": [ "CM.AW-P4", "CM.AW-P6" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Asset Inventories", "scf_control_id": "AST-04", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.4" ], "NIST 800-53 R5.2": [ "CM-08", "PM-05" ], "NIST CSF 2.0": [ "ID.AM", "ID.AM-01", "ID.AM-02" ], "NIST Privacy Framework 1.0": [ "ID.IM-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(d)(2)(iii)" ], "USA California CCPA 2025": [ "7123(c)(4)", "7123(c)(4)(B)" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Network Diagrams & Data Flow Diagrams (DFDs)", "scf_control_id": "AST-17", "crosswalks": { "NIST 800-53 R5.2": [ "PL-02", "SA-04(01)", "SA-04(02)" ], "NIST CSF 2.0": [ "ID.AM-03" ], "NIST Privacy Framework 1.0": [ "ID.IM-P7", "ID.IM-P8" ], "USA California CCPA 2025": [ "7123(c)(4)(A)" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Data Action Mapping", "scf_control_id": "AST-17.2", "crosswalks": { "NIST 800-53 R5.2": [ "CM-13" ], "NIST Privacy Framework 1.0": [ "ID.IM-P4", "ID.IM-P5", "ID.IM-P6", "ID.IM-P8" ], "USA California CCPA 2025": [ "7123(c)(4)(A)" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Sensitive / Regulated Media Records", "scf_control_id": "DCH-10", "crosswalks": { "NIST CSF 2.0": [ "PR.DS" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Data Modeling Guidelines", "scf_control_id": "DCH-34", "crosswalks": { "NIST 800-53 R5.2": [ "PT-03(01)" ] } }, { "principle_name": "Data Flow Mapping", "description": "Maintain a record of processing activities that documents the flow of personal data that includes:\n - Geographic locations and third-parties involved in the storage, transmission and/or processing of personal data;\n - Contact details of the controller(s) involved in the storage, transmission and/or processing of personal data;\n - The purposes of the storage, transmission and processing;\n - A description of the categories of data subjects and personal data;\n - Where possible, the time limits for erasure of the different categories of data; and\n - Where possible, a description of the cybersecurity & data privacy measures of the data controller.", "scf_control": "Sensitive / Regulated Data Actions", "scf_control_id": "IAC-49.1", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(c)(2)" ] } }, { "principle_name": "Data Custodians", "description": "Identify the owners or operators of Technology Assets, Applications and/or Services (TAAS) that process data, or with which data subjects are interacting.", "scf_control": "Technology Assets, Applications, Services and/or Data (TAASD) Ownership Assignment", "scf_control_id": "AST-07.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04(12)" ], "NIST CSF 2.0": [ "ID.AM" ], "NIST Privacy Framework 1.0": [ "ID.IM-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(d)(2)(iii)" ] } }, { "principle_name": "Data Custodians", "description": "Identify the owners or operators of Technology Assets, Applications and/or Services (TAAS) that process data, or with which data subjects are interacting.", "scf_control": "Accountability Information", "scf_control_id": "AST-07.2", "crosswalks": { "NIST 800-53 R5.2": [ "CM-08(04)" ], "NIST CSF 2.0": [ "ID.AM" ], "NIST Privacy Framework 1.0": [ "ID.IM-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(d)(2)(iii)" ] } }, { "principle_name": "Retention of Personal Data", "description": "Ensure that all records containing personal data are maintained in accordance with the organization's records retention schedule and comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Media & Data Retention", "scf_control_id": "DCH-27", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "U4.2-POF1", "U4.2-POF2" ], "NIST 800-53 R5.2": [ "MP-07", "SI-12" ], "NIST Privacy Framework 1.0": [ "CT.DM-P3", "CT.DM-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.316(b)(2)(i)", "§ 164.530(j)(2)" ], "USA California CCPA 2025": [ "7122(g)", "7123(c)(16)", "7155(c)" ], "USA Illinois PIPA 2006": [ "30" ], "USA Montana CDPA 2025": [ "30-14-2819(2)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.200.1" ], "USA Oregon CPA 2023": [ "Section 8(6)" ], "USA Oregon 646A 2025": [ "646A.586(6)" ] } }, { "principle_name": "Retention of Personal Data", "description": "Ensure that all records containing personal data are maintained in accordance with the organization's records retention schedule and comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Minimize Sensitive / Regulated Data Exposure", "scf_control_id": "DCH-27.1", "crosswalks": { "ISO 29100 2024": [ "6.5" ], "NIST 800-53 R5.2": [ "SI-12(01)" ], "NIST Privacy Framework 1.0": [ "CT.DM-P8" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(b)(1)" ] } }, { "principle_name": "Secure Destruction of Personal Data", "description": "Utilize secure methods to dispose of or destroy both physical and digital media that contains personal data.", "scf_control": "Digital & Non-Digital Media Disposal", "scf_control_id": "DCH-17", "crosswalks": { "NIST 800-53 R5.2": [ "MP-06", "SI-12(03)" ], "USA California CCPA 2025": [ "7123(c)(16)" ], "USA Illinois PIPA 2006": [ "40(b)", "40(b)(1)", "40(b)(2)", "40(c)" ], "USA Nevada Privacy Law 2023": [ "603A.200.1" ] } }, { "principle_name": "Secure Destruction of Personal Data", "description": "Utilize secure methods to dispose of or destroy both physical and digital media that contains personal data.", "scf_control": "Sanitization of Sensitive / Regulated Data", "scf_control_id": "DCH-18.1", "crosswalks": { "NIST 800-53 R5.2": [ "MP-06", "MP-06(03)" ], "USA Alaska PIPA 2029": [ "45.48.500 - .590" ], "USA California CCPA 2025": [ "7123(c)(16)" ] } }, { "principle_name": "Geolocation Restrictions", "description": "Restrict the location of processing, storage and service locations to comply with the data privacy notice, as well as applicable statutory, regulatory and contractual obligations.", "scf_control": "Logical Data Location", "scf_control_id": "DCH-29", "crosswalks": { "NIST 800-53 R5.2": [ "CM-12" ] } }, { "principle_name": "Geolocation Restrictions", "description": "Restrict the location of processing, storage and service locations to comply with the data privacy notice, as well as applicable statutory, regulatory and contractual obligations.", "scf_control": "Geolocation Requirements for Processing, Storage and Service Locations", "scf_control_id": "DCH-30.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09(05)", "SA-09(08)" ] } }, { "principle_name": "Geolocation Restrictions", "description": "Restrict the location of processing, storage and service locations to comply with the data privacy notice, as well as applicable statutory, regulatory and contractual obligations.", "scf_control": "External Transfer of Sensitive / Regulated Data", "scf_control_id": "DCH-32", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.1", "S7.3" ], "EMEA EU GDPR 2016": [ "Article 44", "Article 45.1", "Article 46.1", "Article 46.2", "Article 46.2(a)", "Article 49.1", "Article 49.1(a)", "Article 49.1(b)", "Article 49.1(c)", "Article 49.1(d)", "Article 49.1(e)", "Article 49.1(f)", "Article 49.1(g)", "Article 49.2", "Article 49.3", "Article 49.4", "Article 49.6" ], "EMEA UK DPA 2018": [ "Section 109(1)", "Section 109(1)(a)", "Section 109(1)(b)", "Section 109(2)", "Section 109(2)(a)", "Section 109(2)(b)" ] } }, { "principle_name": "Geolocation Restrictions", "description": "Restrict the location of processing, storage and service locations to comply with the data privacy notice, as well as applicable statutory, regulatory and contractual obligations.", "scf_control": "Distributed Processing & Storage", "scf_control_id": "SEA-25", "crosswalks": { "NIST 800-53 R5.2": [ "PE-23", "SC-36" ] } }, { "principle_name": "Geolocation Restrictions", "description": "Restrict the location of processing, storage and service locations to comply with the data privacy notice, as well as applicable statutory, regulatory and contractual obligations.", "scf_control": "Third-Party Processing, Storage and Service Locations", "scf_control_id": "TPM-12.2", "crosswalks": { "NIST 800-53 R5.2": [ "PE-23", "SA-09(05)" ], "NIST CSF 2.0": [ "GV.SC-06" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Data Portability", "description": "Provide the functionality to export personal data in a structured, commonly-used and machine-readable format that can be transferred to another controller without hindrance.", "scf_control": "Data Portability", "scf_control_id": "PRI-41", "crosswalks": { "NIST Privacy Framework 1.0": [ "ID.DE-P4", "CT.DM-P6" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.524(c)(2)(i)", "§ 164.524(c)(2)(ii)" ], "USA California CCPA 2025": [ "7024(g)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)(e)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(d)" ], "USA Oregon CPA 2023": [ "Section 3(2)" ], "USA Oregon 646A 2025": [ "646A.574(2)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(D)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.4" ], "EMEA EU GDPR 2016": [ "Article 20.1" ] } }, { "principle_name": "Data Portability", "description": "Provide the functionality to export personal data in a structured, commonly-used and machine-readable format that can be transferred to another controller without hindrance.", "scf_control": "Personal Data (PD) Exports", "scf_control_id": "PRI-41.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "A5.1-POF3", "D6.7" ], "APEC Privacy Framework 2015": [ "8(a)", "8(b)", "8(b)(i)", "8(b)(ii)", "8(b)(iii)", "8(b)(iv)" ], "NIST Privacy Framework 1.0": [ "CT.DM-P6" ], "OECD Privacy Principles": [ "7(b)", "7(b)(iv)" ], "USA California CCPA 2025": [ "7024(g)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)(e)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(d)" ], "USA Oregon CPA 2023": [ "Section 3(1)(a)(C)", "Section 3(2)" ], "USA Oregon 646A 2025": [ "646A.574(1)(a)(C)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(D)" ], "USA Texas CDPA 2025": [ "541.051(b)(4)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.4" ], "EMEA EU GDPR 2016": [ "Article 20.1", "Article 20.1(b)" ], "EMEA UK DPA 2018": [ "Section 52(1)", "Section 52(2)", "Section 52(3)", "Section 52(5)" ], "APAC New Zealand Privacy Act of 2020": [ "4.1.58(1)", "4.1.58(1)(a)", "4.1.58(1)(b)", "4.1.58(1)(c)", "4.1.58(1)(d)", "4.1.58(1)(e)", "4.1.58(1)(f)" ] } }, { "principle_name": "Record of Disclosures", "description": "Develop and maintain an accounting of personal data disclosures that upon request can be made available to the individual whose personal data was disclosed.", "scf_control": "Documenting Data Processing Activities", "scf_control_id": "PRI-05", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.2", "D6.2-POF1" ], "NIST 800-53 R5.2": [ "PM-27" ], "NIST Privacy Framework 1.0": [ "CM.AW-P4", "CM.AW-P6" ], "USA Nevada Privacy Law 2023": [ "603A.535.3", "603A.535.3(a)", "603A.535.3(b)", "603A.535.3(c)", "603A.535.3(d)", "603A.535.3(e)", "603A.535.3(f)", "603A.535.3(g)", "603A.535.3(h)", "603A.535.3(i)", "603A.535.8" ], "USA Texas CDPA 2025": [ "541.052(f)(1)" ], "EMEA EU GDPR 2016": [ "Article 30.1", "Article 30.1(a)", "Article 30.1(b)", "Article 30.1(c)", "Article 30.1(d)", "Article 30.1(e)", "Article 30.1(f)", "Article 30.1(g)", "Article 30.2", "Article 30.2(a)", "Article 30.2(b)", "Article 30.2(c)", "Article 30.2(d)", "Article 30.3" ], "EMEA UK DPA 2018": [ "Section 61(1)", "Section 61(2)", "Section 61(2)(a)", "Section 61(2)(b)", "Section 61(2)(c)", "Section 61(2)(d)", "Section 61(2)(e)", "Section 61(2)(f)", "Section 61(2)(f)(i)", "Section 61(2)(f)(ii)", "Section 61(2)(g)", "Section 61(2)(h)", "Section 61(2)(h)(i)", "Section 61(2)(j)", "Section 61(2)(k)", "Section 61(3)", "Section 61(4)", "Section 61(4)(a)", "Section 61(4)(b)", "Section 61(4)(c)", "Section 61(4)(d)", "Section 61(4)(e)", "Section 61(4)(f)", "Section 61(5)", "Section 62(1)", "Section 62(1)(a)", "Section 62(1)(b)", "Section 62(1)(c)", "Section 62(1)(d)", "Section 62(1)(e)", "Section 62(1)(f)", "Section 62(2)", "Section 62(2)(a)", "Section 62(2)(b)", "Section 62(3)", "Section 62(3)(a)", "Section 62(3)(b)", "Section 62(3)(b)(i)", "Section 62(3)(b)(ii)", "Section 62(4)", "Section 62(4)(a)", "Section 62(4)(b)", "Section 62(4)(c)", "Section 62(4)(d)", "Section 62(5)" ], "APAC Australian Privacy Principles 2026": [ "3.6.5" ], "Americas Canada PIPEDA 2000": [ "P5-4.5.1" ] } }, { "principle_name": "Record of Disclosures", "description": "Develop and maintain an accounting of personal data disclosures that upon request can be made available to the individual whose personal data was disclosed.", "scf_control": "Accounting of Disclosures", "scf_control_id": "PRI-17.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.2", "D6.2-POF1", "D6.3", "D6.3-POF1" ], "NIST 800-53 R5.2": [ "PM-21" ], "NIST Privacy Framework 1.0": [ "CM.AW-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.528(a)(1)", "§ 164.528(a)(1)(i)", "§ 164.528(a)(1)(ii)", "§ 164.528(a)(1)(iii)", "§ 164.528(a)(1)(iv)", "§ 164.528(a)(1)(v)", "§ 164.528(a)(1)(vi)", "§ 164.528(a)(1)(vii)", "§ 164.528(a)(1)(viii)", "§ 164.528(a)(1)(ix)", "§ 164.528(b)", "§ 164.528(b)(1)", "§ 164.528(b)(2)", "§ 164.528(b)(2)(i)", "§ 164.528(b)(2)(ii)", "§ 164.528(b)(2)(iii)", "§ 164.528(b)(2)(iv)", "§ 164.528(b)(3)", "§ 164.528(b)(3)(i)", "§ 164.528(b)(3)(ii)", "§ 164.528(b)(3)(iii)", "§ 164.528(b)(4)(i)", "§ 164.528(b)(4)(i)(A)", "§ 164.528(b)(4)(i)(B)", "§ 164.528(b)(4)(i)(C)", "§ 164.528(b)(4)(i)(D)", "§ 164.528(b)(4)(i)(E)", "§ 164.528(b)(4)(i)(F)", "§ 164.528(b)(4)(ii)", "§ 164.528(c)(1)", "§ 164.528(c)(1)(i)", "§ 164.528(c)(1)(ii)", "§ 164.528(c)(1)(ii)(A)", "§ 164.528(c)(1)(ii)(B)", "§ 164.528(c)(2)", "§ 164.528(d)", "§ 164.528(d)(1)", "§ 164.528(d)(2)", "§ 164.528(d)(3)" ], "USA Oregon CPA 2023": [ "Section 3(1)(a)(B)(i)", "Section 3(1)(a)(B)(ii)" ], "Americas Canada PIPEDA 2000": [ "P9-4.9.3" ] } }, { "principle_name": "Integrity Protections", "description": "Maintain the accuracy and relevance of personal data across the information lifecycle as personal data is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Sensitive / Regulated Data Governance", "scf_control_id": "DCH-03", "crosswalks": { "NIST 800-53 R5.2": [ "PM-23", "PM-24" ] } }, { "principle_name": "Integrity Protections", "description": "Maintain the accuracy and relevance of personal data across the information lifecycle as personal data is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Personal Data (PD) Accuracy & Integrity", "scf_control_id": "PRI-35", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF7", "Q8.1", "Q8.1-POF2" ], "APEC Privacy Framework 2015": [ "6" ], "ISO 29100 2024": [ "6.7" ], "NIST 800-53 R5.2": [ "PM-24" ], "USA Federal Data Privacy Framework 2023": [ "II.5.a" ], "EMEA EU GDPR 2016": [ "Article 5.1(d)" ], "EMEA UK DPA 2018": [ "Section 46(1)", "Section 47(3)" ], "APAC Australian Privacy Principles 2026": [ "4.10.1", "4.10.2" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.8" ], "Americas Canada PIPEDA 2000": [ "P6-4.6", "P6-4.6.1", "P6-4.6.2", "P6-4.6.3" ] } }, { "principle_name": "De-Identification", "description": "Process personal data in such a manner that it is not attributable to a data subject through technical or organizational measures (e.g., anonymization, pseudonymization or data minimization).", "scf_control": "De-Identification (Anonymization)", "scf_control_id": "DCH-36", "crosswalks": { "NIST 800-53 R5.2": [ "SI-19", "SI-19(04)" ], "NIST Privacy Framework 1.0": [ "CT.DP-P2", "CT.DP-P3" ], "USA Federal Data Privacy Framework 2023": [ "III.14.a.i", "III.14.g.i" ], "USA California CCPA 2025": [ "7123(c)(5)(C)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(c)", "30-14-2815(1)(a)", "30-14-2815(4)" ], "USA Oregon CPA 2023": [ "Section 7(1)(a)(A)" ], "USA Oregon 646A 2025": [ "646A.583(1)(a)(A)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(C)" ], "USA Texas CDPA 2025": [ "541.106(a)(1)" ], "USA Virginia CDPA 2023": [ "59.1-581.A.1" ] } }, { "principle_name": "Quality Management", "description": "Maintain quality assurances throughout the information lifecycle with such accuracy, relevance, timeliness and completeness as is reasonably necessary to ensure fairness to the individual.", "scf_control": "Data Quality Management", "scf_control_id": "DCH-33.2", "crosswalks": { "NIST 800-53 R5.2": [ "PM-22", "PM-23", "PM-24" ], "NIST Privacy Framework 1.0": [ "CT.PO-P4" ], "OECD Privacy Principles": [ "2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.512(i)(1)(i)(B)", "§ 164.512(i)(1)(i)(B)(1)", "§ 164.512(i)(1)(i)(B)(2)", "§ 164.512(i)(1)(i)(B)(3)" ], "USA Federal FIPPS 1973": [ "5" ], "USA California CCPA 2025": [ "7023(c)" ] } }, { "principle_name": "Quality Management", "description": "Maintain quality assurances throughout the information lifecycle with such accuracy, relevance, timeliness and completeness as is reasonably necessary to ensure fairness to the individual.", "scf_control": "Data Quality Automation", "scf_control_id": "DCH-33.3", "crosswalks": { "NIST 800-53 R5.2": [ "PT-03(02)" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Secure Development Life Cycle (SDLC) Management", "scf_control_id": "PRM-07", "crosswalks": { "NIST 800-53 R5.2": [ "SA-03", "SA-03(01)", "SA-08(30)" ], "NIST CSF 2.0": [ "GV.SC-09", "ID.AM-08", "PR.PS-02", "PR.PS-03" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P4", "CM.AW-P3" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Security, Compliance & Resilience In Project Management", "scf_control_id": "PRM-08", "crosswalks": { "NIST 800-53 R5.2": [ "CA-02" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P4", "CM.AW-P3" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Security, Compliance & Resilience Requirements Definition", "scf_control_id": "PRM-09", "crosswalks": { "ISO 27701 2025": [ "6.1.1" ], "NIST 800-53 R5.2": [ "RA-09" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(2)(ii)" ], "USA California CCPA 2025": [ "7100(b)" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Business Process Definition", "scf_control_id": "PRM-10", "crosswalks": { "ISO 27701 2025": [ "4.1", "4.2", "4.2(a)", "4.2(b)", "4.2(c)", "6.1.1" ], "NIST 800-53 R5.2": [ "PM-11" ], "NIST Privacy Framework 1.0": [ "ID.IM-P5", "ID.BE-P1", "ID.BE-P3", "GV.RM-P3", "CT.PO-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(2)(i)" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Manage Organizational Knowledge", "scf_control_id": "PRM-11", "crosswalks": {} }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Secure Engineering Principles", "scf_control_id": "SEA-05", "crosswalks": { "NIST 800-53 R5.2": [ "PT-01", "SA-08", "SA-15(05)", "SC-01", "SC-07(18)", "SI-01" ], "NIST CSF 2.0": [ "PR.IR", "PR.IR-01", "PR.IR-03" ], "NIST Privacy Framework 1.0": [ "ID.DE-P4", "GV.PO-P2", "CM.AW-P3", "PR.DS-P5" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(1)" ], "USA California CCPA 2025": [ "7123(c)(5)(B)" ] } }, { "principle_name": "Secure Data Processing", "description": "Implement secure data processing practices so that the confidentiality, integrity and pertinent attributes of sensitive/regulated data is maintained throughout the data lifecycle.", "scf_control": "Secure Software Development Practices (SSDP)", "scf_control_id": "TDA-05", "crosswalks": { "NIST 800-53 R5.2": [ "SA-01", "SA-04(03)", "SA-15" ], "NIST CSF 2.0": [ "PR.PS-06" ], "NIST Privacy Framework 1.0": [ "CT.DP-P1" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Data Lineage", "description": "Maintain records of the inputs, entities and associated Technology Assets, Applications and/or Services (TAAS) that influence data of interest, providing a historical record of the data and its origins.", "scf_control": "Applied Security, Compliance and Resilience Controls Documentation", "scf_control_id": "IAO-09", "crosswalks": { "NIST 800-53 R5.2": [ "PL-02" ], "NIST Privacy Framework 1.0": [ "ID.IM-P7", "ID.BE-P3" ] } }, { "principle_name": "Data Lineage", "description": "Maintain records of the inputs, entities and associated Technology Assets, Applications and/or Services (TAAS) that influence data of interest, providing a historical record of the data and its origins.", "scf_control": "Personal Data (PD) Lineage", "scf_control_id": "PRI-05.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04(12)" ], "NIST Privacy Framework 1.0": [ "CM.AW-P4", "CM.AW-P6" ] } }, { "principle_name": "Updated Use Permissions", "description": "Implement data management processes to adjust data that is able to be collected, created, used, disseminated, maintained, retained and/or disclosed, based on updated data subject authorization(s).", "scf_control": "Just-In-Time Notice & Updated Consent", "scf_control_id": "PRI-24.4", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "N2.1-POF1", "N2.1-POF2", "N2.2", "C3.2-POF1" ], "NIST 800-53 R5.2": [ "PT-04(02)", "PT-05(01)" ], "NIST Privacy Framework 1.0": [ "CT.PO-P1", "CT.PO-P3" ], "USA Federal Data Privacy Framework 2023": [ "III.14.b.i", "III.14.b.ii" ], "USA California CCPA 2025": [ "7002(f)", "7010(f)", "7022(g)", "7022(h)", "7025(c)(5)", "7026(k)", "7027(l)", "7221(i)", "7221(k)" ], "USA Montana CDPA 2025": [ "30-14-2812(8)" ], "Americas Canada PIPEDA 2000": [ "P2-4.2.4" ] } }, { "principle_name": "Updated Use Permissions", "description": "Implement data management processes to adjust data that is able to be collected, created, used, disseminated, maintained, retained and/or disclosed, based on updated data subject authorization(s).", "scf_control": "Automated Decision-Making Technology (ADMT)", "scf_control_id": "PRI-36", "crosswalks": { "NIST 800-53 R5.2": [ "PM-24", "PT-02(02)", "PT-03(02)" ], "EMEA UK DPA 2018": [ "Section 50B(1)", "Section 50B(2)", "Section 50B(3)", "Section 96(1)", "Section 96(2)", "Section 96(2)(a)", "Section 96(2)(b)", "Section 96(2)(c)", "Section 96(2)(c)(i)", "Section 96(2)(c)(ii)", "Section 96(2)(c)(iii)", "Section 96(3)", "Section 96(4)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Updating & Correcting Personal Data (PD)", "scf_control_id": "PRI-08.1", "crosswalks": { "NIST 800-53 R5.2": [ "SI-18(04)", "SI-18(05)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(a)(1)", "§ 164.526(b)(1)" ], "USA California CCPA 2025": [ "7023(c)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.2" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(4)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Flaw Remediation with Personal Data (PD)", "scf_control_id": "PRI-08.2", "crosswalks": {} }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Vulnerability Disclosure Program (VDP)", "scf_control_id": "THR-12", "crosswalks": { "NIST 800-53 R5.2": [ "RA-05(11)" ], "USA California CCPA 2025": [ "7123(c)(6)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Vulnerability & Patch Management Program (VPMP)", "scf_control_id": "VPM-02", "crosswalks": { "NIST 800-53 R5.2": [ "SI-02", "SI-03" ], "NIST CSF 2.0": [ "ID.RA-01", "ID.RA-08", "PR.PS-02" ], "NIST Privacy Framework 1.0": [ "PR.PO-P10" ], "USA California CCPA 2025": [ "7123(c)(5)(D)", "7123(c)(6)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Attack Surface Scope", "scf_control_id": "VPM-03", "crosswalks": { "NIST 800-53 R5.2": [ "SA-11(06)", "SA-11(07)" ], "NIST CSF 2.0": [ "PR.PS-02" ], "USA California CCPA 2025": [ "7123(c)(5)(D)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Vulnerability Ranking", "scf_control_id": "VPM-05", "crosswalks": { "NIST CSF 2.0": [ "ID.RA-08" ], "USA California CCPA 2025": [ "7123(c)(5)(D)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Vulnerability Remediation Process", "scf_control_id": "VPM-06", "crosswalks": { "NIST 800-53 R5.2": [ "PM-04", "SC-18(01)" ], "NIST CSF 2.0": [ "ID.RA-08", "PR.PS-02" ], "USA California CCPA 2025": [ "7123(c)(5)(D)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Continuous Vulnerability Remediation Activities", "scf_control_id": "VPM-06.2", "crosswalks": { "NIST 800-53 R5.2": [ "SC-18(01)" ], "USA California CCPA 2025": [ "7123(c)(5)(D)" ] } }, { "principle_name": "Flaw Remediation with Personal Data", "description": "Identify and correct flaws related to personal data as it is collected, created, used, disseminated, maintained, retained and/or disclosed.", "scf_control": "Software & Firmware Patching", "scf_control_id": "VPM-08", "crosswalks": { "NIST 800-53 R5.2": [ "SI-02", "SI-02(04)", "SI-03" ], "NIST CSF 2.0": [ "PR.PS-02" ], "USA California CCPA 2025": [ "7123(c)(5)(A)", "7123(c)(5)(D)" ] } }, { "principle_name": "Analytical Biases", "description": "Understand and evaluate data analytic inputs and outputs for potential bias.", "scf_control": "Data Analytics Bias", "scf_control_id": "DCH-35", "crosswalks": {} }, { "principle_name": "Data Subject Rights", "description": "Provide data subjects with appropriate access to their personal data.", "scf_control": "Disclosure Request Rejections", "scf_control_id": "PRI-18.1", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.524(d)(2)(i)", "§ 164.524(d)(2)(ii)", "§ 164.524(d)(2)(iii)", "§ 164.524(d)(3)" ], "USA California CCPA 2025": [ "7022(a)", "7023(b)", "7024(a)", "7024(b)", "7026(e)" ], "USA Oregon CPA 2023": [ "Section 4(5)(e)(B)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(b)(4)" ], "USA Texas CDPA 2025": [ "541.052(e)" ], "EMEA UK DPA 2018": [ "Section 53(1)", "Section 53(1)(a)", "Section 53(1)(b)", "Section 53(2)", "Section 53(3)", "Section 53(4)", "Section 53(4A)", "Section 53(4A)(a)", "Section 53(4A)(b)", "Section 53(5)" ], "APAC Australian Privacy Principles 2026": [ "5.12.3.h.i" ], "APAC New Zealand Privacy Act of 2020": [ "4.1.46(1)" ] } }, { "principle_name": "Data Subject Rights", "description": "Provide data subjects with appropriate access to their personal data.", "scf_control": "Active Participation For Consent By Data Subjects", "scf_control_id": "PRI-24.1", "crosswalks": { "ISO 29100 2024": [ "6.5" ], "OECD Privacy Principles": [ "1" ], "USA Federal Data Privacy Framework 2023": [ "II.2.c", "III.12.a", "III.12.b" ], "USA California CCPA 2025": [ "7010(e)", "7010(f)", "7025(c)(4)", "7027(b)", "7027(i)" ], "USA Montana CDPA 2025": [ "30-14-2809(3)(b)" ], "USA Oregon CPA 2023": [ "Section 3(1)(d)(A)", "Section 3(1)(d)(B)", "Section 3(1)(d)(C)", "Section 5(6)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(b)" ], "USA Texas CDPA 2025": [ "541.051(b)(5)(A)", "541.051(b)(5)(B)", "541.051(b)(5)(C)", "541.052(f)(2)" ], "USA Virginia CDPA 2023": [ "59.1-577.A", "59.1-577.A.5" ] } }, { "principle_name": "Data Subject Rights", "description": "Provide data subjects with appropriate access to their personal data.", "scf_control": "Data Subject Empowerment", "scf_control_id": "PRI-39.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "A5.1", "A5.1-POF2", "D6.7", "D6.7-POF1", "D6.7-POF2" ], "APEC Privacy Framework 2015": [ "8(c)" ], "ISO 29100 2024": [ "6.9", "6.10" ], "NIST 800-53 R5.2": [ "AC-03(14)", "SI-18(04)" ], "OECD Privacy Principles": [ "7(a)" ], "USA Federal Data Privacy Framework 2023": [ "II.6.a", "III.8.a.i", "III.8.a.i.1", "III.8.a.i.2", "III.8.a.i.3", "III.8.a.iii", "III.8.b.i", "III.8.b.ii", "III.8.d.ii", "III.8.e.i", "III.8.f.i", "III.14.e.ii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.502(a)(2)(i)", "§ 164.514(h)(1)(i)", "§ 164.514(h)(1)(ii)", "§ 164.524(a)(1)", "§ 164.524(a)(1)(i)", "§ 164.524(a)(1)(ii)", "§ 164.524(a)(1)(iii)", "§ 164.524(a)(1)(iii)(A)", "§ 164.524(a)(1)(iii)(B)", "§ 164.524(a)(2)", "§ 164.524(a)(2)(i)", "§ 164.524(a)(2)(ii)", "§ 164.524(a)(2)(iii)", "§ 164.524(a)(2)(iv)", "§ 164.524(a)(2)(v)", "§ 164.524(a)(3)", "§ 164.524(a)(3)(i)", "§ 164.524(a)(3)(ii)", "§ 164.524(a)(3)(iii)", "§ 164.524(a)(4)", "§ 164.524(b)(1)", "§ 164.524(b)(2)(i)", "§ 164.524(b)(2)(i)(A)", "§ 164.524(b)(2)(i)(B)", "§ 164.524(b)(2)(ii)", "§ 164.524(b)(2)(ii)(A)", "§ 164.524(b)(2)(ii)(B)", "§ 164.524(c)", "§ 164.524(c)(1)", "§ 164.524(c)(3)(i)", "§ 164.524(c)(3)(ii)", "§ 164.524(c)(4)", "§ 164.524(c)(4)(i)", "§ 164.524(c)(4)(ii)", "§ 164.524(c)(4)(iii)", "§ 164.524(c)(4)(iv)", "§ 164.524(d)", "§ 164.524(d)(1)", "§ 164.524(d)(2)" ], "USA Federal FIPPS 1973": [ "1", "6" ], "USA California CCPA 2025": [ "7020(a)", "7020(b)", "7020(c)", "7020(d)", "7020(e)", "7020(f)", "7020(f)(1)", "7020(f)(2)", "7022(b)", "7023(c)", "7023(d)(1)", "7024(g)", "7024(h)", "7024(j)", "7027(d)", "7027(e)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)", "6-1-1306(1)(b)", "6-1-1306(2)(c)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(a)", "30-14-2808(2)", "30-14-2808(6)", "30-14-2812(11)(a)", "30-14-2812(11)(b)" ], "USA Nevada Privacy Law 2023": [ "603A.345.2", "603A.346.2", "603A.505.1(a)", "603A.505.1(b)", "603A.505.2", "603A.505.2(a)", "603A.510.3(a)(1)", "603A.510.3(a)(2)" ], "USA Nevada SB220 2019": [ "2.1", "2.2" ], "USA Oregon CPA 2023": [ "Section 3(1)(a)(A)" ], "USA Oregon 646A 2025": [ "646A.574(1)(a)", "646A.574(1)(a)(A)", "646A.574(1)(a)(B)", "646A.574(1)(a)(B)(i)", "646A.574(1)(a)(B)(ii)", "646A.576(1)", "646A.578(5)", "646A.578(5)(a)", "646A.578(5)(a)(A)", "646A.578(5)(a)(B)", "646A.578(5)(a)(C)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(1)", "47-18-3203(a)(2)(A)" ], "USA Texas CDPA 2025": [ "541.051(a)", "541.055(a)(1)" ], "USA Virginia CDPA 2023": [ "59.1-577.A", "59.1-577.A.1", "59.1-577.A.2", "59.1-577.A.3", "59.1-577.A.4" ], "EMEA EU GDPR 2016": [ "Article 12.3", "Article 12.5(b)", "Article 12.6", "Article 15.1", "Article 15.1(a)", "Article 15.1(b)", "Article 15.1(c)", "Article 15.1(d)", "Article 15.1(e)", "Article 15.1(g)", "Article 15.1(h)", "Article 15.2", "Article 15.3", "Article 15.4", "Article 16", "Article 17.1", "Article 18.1", "Article 18.1(a)", "Article 18.1(b)", "Article 18.1(c)", "Article 18.1(d)" ], "EMEA UK DPA 2018": [ "Section 45(1)", "Section 45(1)(a)", "Section 45(1)(b)", "Section 45(2)", "Section 45(2)(a)", "Section 45(2)(b)", "Section 45(2)(c)", "Section 45(2)(d)", "Section 45(2)(e)", "Section 45(2)(e)(i)", "Section 45(2)(e)(ii)", "Section 45(2)(f)", "Section 45(2)(g)", "Section 45(2A)" ], "APAC Australian Privacy Principles 2026": [ "3.7.6", "3.7.6.a", "3.7.6.b", "3.7.6.c", "3.7.6.d", "3.7.6.e", "3.7.7", "3.7.7.a", "3.7.7.b", "5.12.1" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.6(1)", "3.1.22.6(1)(a)", "3.1.22.6(1)(b)", "3.1.22.6(2)", "3.1.22.7(1)", "3.1.22.7(3)", "3.1.22.7(3)(a)", "4.2.59" ], "Americas Canada PIPEDA 2000": [ "P9-4.9", "P10-4.10" ] } }, { "principle_name": "Inquiry Management", "description": "Maintain a capability to receive and respond to data privacy-related requests, complaints, concerns or questions from data subjects.", "scf_control": "Updating & Correcting Personal Data (PD)", "scf_control_id": "PRI-08.1", "crosswalks": { "NIST 800-53 R5.2": [ "SI-18(04)", "SI-18(05)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(a)(1)", "§ 164.526(b)(1)" ], "USA California CCPA 2025": [ "7023(c)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.2" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(4)" ] } }, { "principle_name": "Inquiry Management", "description": "Maintain a capability to receive and respond to data privacy-related requests, complaints, concerns or questions from data subjects.", "scf_control": "Disclosure Request Rejections", "scf_control_id": "PRI-18.1", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.524(d)(2)(i)", "§ 164.524(d)(2)(ii)", "§ 164.524(d)(2)(iii)", "§ 164.524(d)(3)" ], "USA California CCPA 2025": [ "7022(a)", "7023(b)", "7024(a)", "7024(b)", "7026(e)" ], "USA Oregon CPA 2023": [ "Section 4(5)(e)(B)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(b)(4)" ], "USA Texas CDPA 2025": [ "541.052(e)" ], "EMEA UK DPA 2018": [ "Section 53(1)", "Section 53(1)(a)", "Section 53(1)(b)", "Section 53(2)", "Section 53(3)", "Section 53(4)", "Section 53(4A)", "Section 53(4A)(a)", "Section 53(4A)(b)", "Section 53(5)" ], "APAC Australian Privacy Principles 2026": [ "5.12.3.h.i" ], "APAC New Zealand Privacy Act of 2020": [ "4.1.46(1)" ] } }, { "principle_name": "Inquiry Management", "description": "Maintain a capability to receive and respond to data privacy-related requests, complaints, concerns or questions from data subjects.", "scf_control": "Data Subject Authentication", "scf_control_id": "PRI-38", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "A5.1-POF1" ], "USA California CCPA 2025": [ "7060(a)", "7060(b)", "7060(c)", "7060(c)(1)", "7060(c)(2)", "7060(c)(3)", "7060(c)(3)(A)", "7060(c)(3)(B)", "7060(c)(3)(C)", "7060(c)(3)(D)", "7060(c)(3)(E)", "7060(c)(3)(F)", "7060(d)", "7060(e)", "7060(f)", "7060(g)", "7060(h)", "7061(a)", "7061(b)", "7062(a)", "7062(b)", "7062(c)", "7062(d)", "7062(f)", "7062(g)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)", "6-1-1306(2)(d)" ], "USA Montana CDPA 2025": [ "30-14-2808(4)(d)", "30-14-2809(2)" ], "USA Nevada Privacy Law 2023": [ "603A.505.2(b)" ], "USA Oregon 646A 2025": [ "646A.576(2)" ], "EMEA UK DPA 2018": [ "Section 52(4)", "Section 52(4)(a)", "Section 52(4)(b)" ], "APAC Australian Privacy Principles 2026": [ "1.2.2.a", "1.2.2.b" ], "Americas Canada PIPEDA 2000": [ "P9-4.9.2" ] } }, { "principle_name": "Inquiry Management", "description": "Maintain a capability to receive and respond to data privacy-related requests, complaints, concerns or questions from data subjects.", "scf_control": "Data Subject Rights Management", "scf_control_id": "PRI-39", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "A5.1-POF4", "A5.2-POF1", "A5.2-POF3", "M9.1", "M9.1-POF2", "M9.1-POF3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "PM-26" ], "NIST Privacy Framework 1.0": [ "GV.MT-P7" ], "OECD Privacy Principles": [ "7(b)(i)", "7(b)(ii)", "7(b)(iii)", "7(c)", "7(d)" ], "USA Federal Data Privacy Framework 2023": [ "II.7.a.i", "III.8.i.i", "III.11.d.i" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(b)(2)(i)", "§ 164.526(b)(2)(i)(A)", "§ 164.526(b)(2)(i)(B)", "§ 164.526(b)(2)(ii)", "§ 164.526(b)(2)(ii)(A)", "§ 164.526(b)(2)(ii)(B)", "§ 164.526(d)", "§ 164.526(d)(1)", "§ 164.526(d)(1)(i)", "§ 164.526(d)(1)(ii)", "§ 164.526(d)(1)(iii)", "§ 164.526(d)(1)(iv)", "§ 164.526(d)(2)", "§ 164.526(d)(3)", "§ 164.526(d)(4)", "§ 164.526(d)(5)(i)", "§ 164.526(d)(5)(ii)", "§ 164.526(d)(5)(iii)", "§ 164.526(e)", "§ 164.526(f)", "§ 164.530(d)(1)", "§ 164.530(d)(2)" ], "USA Federal FIPPS 1973": [ "6" ], "USA California CCPA 2025": [ "7021(a)", "7021(b)", "7022(e)", "7022(f)", "7022(f)(1)", "7023(a)", "7023(d)(2)(A)", "7023(d)(2)(B)", "7023(d)(2)(C)", "7023(d)(2)(D)", "7023(f)(1)", "7023(f)(2)", "7023(f)(3)", "7023(f)(4)", "7023(i)", "7023(j)", "7023(k)", "7024(c)", "7024(c)(1)", "7024(c)(2)", "7024(c)(3)", "7024(c)(4)", "7024(d)", "7024(d)(1)", "7024(d)(2)", "7024(e)", "7024(e)(1)", "7024(e)(2)", "7024(k)", "7024(k)(1)", "7024(k)(2)", "7024(k)(3)", "7024(k)(4)", "7024(k)(5)", "7024(k)(6)", "7027(h)", "7027(k)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)", "6-1-1306(2)(a)", "6-1-1306(2)(b)", "6-1-1306(3)(b)", "6-1-1306(3)(c)" ], "USA Montana CDPA 2025": [ "30-14-2808(4)(a)", "30-14-2808(4)(b)", "30-14-2808(4)(c)", "30-14-2808(4)(d)", "30-14-2808(5)", "30-14-2812(11)(a)", "30-14-2813(1)(a)" ], "USA Nevada Privacy Law 2023": [ "603A.345.3", "603A.345.4", "603A.346.3", "603A.346.4", "603A.510.1", "603A.510.2", "603A.510.2(a)", "603A.510.2(b)" ], "USA Nevada SB220 2019": [ "2.4" ], "USA Oregon CPA 2023": [ "Section 4(5)(a)", "Section 4(5)(b)", "Section 4(5)(c)", "Section 4(5)(d)", "Section 4(5)(e)", "Section 4(5)(e)(A)", "Section 4(5)(e)(B)", "Section 4(6)(b)", "Section 4(6)(c)", "Section 4(6)(d)", "Section 5(5)(a)(A)", "Section 5(5)(a)(B)", "Section 5(5)(a)(C)", "Section 5(5)(b)" ], "USA Oregon 646A 2025": [ "646A.576(5)", "646A.576(5)(a)", "646A.576(5)(b)", "646A.576(5)(c)", "646A.576(5)(d)", "646A.576(5)(e)", "646A.576(5)(e)(A)", "646A.576(5)(e)(B)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(b)(1)", "47-18-3203(b)(2)", "47-18-3203(b)(3)", "47-18-3203(b)(4)", "47-18-3204(e)(1)(A)", "47-18-3204(e)(1)(B)", "47-18-3204(e)(1)(C)", "47-18-3204(e)(2)", "47-18-3207(b)(3)", "47-18-3207(b)(3)(A)", "47-18-3207(b)(3)(B)", "47-18-3207(b)(3)(C)" ], "USA Texas CDPA 2025": [ "541.051(b)(1)", "541.052(b)", "541.052(c)", "541.052(d)", "541.053(c)", "541.053(d)", "541.055(a)(2)", "541.055(a)(3)", "541.055(b)" ], "USA Virginia CDPA 2023": [ "59.1-577.B.1", "59.1-577.B.2", "59.1-577.B.3", "59.1-577.B.4", "59.1-577.C" ], "EMEA EU GDPR 2016": [ "Article 12.4" ], "EMEA UK DPA 2018": [ "Section 45(3)", "Section 45(3)(a)", "Section 45(3)(b)", "Section 45(5)", "Section 45(5)(a)", "Section 45(5)(b)", "Section 45(5)(c)", "Section 45(5)(d)", "Section 45(5)(e)", "Section 52(6)", "Section 53(6)", "Section 53(6)(a)", "Section 53(6)(b)", "Section 53(7)", "Section 53(7)(a)", "Section 53(7)(b)", "Section 59(2)(b)" ], "APAC Australian Privacy Principles 2026": [ "5.12.3", "5.12.3.a", "5.12.3.b", "5.12.3.c", "5.12.3.d", "5.12.3.e", "5.12.3.f", "5.12.3.g", "5.12.3.h", "5.12.3.h.ii", "5.12.3.i", "5.12.3.j", "5.12.4", "5.12.4.a", "5.12.4.a.i", "5.12.4.a.ii", "5.12.4.b", "5.12.5", "5.12.5.a", "5.12.5.b", "5.12.6", "5.13.4", "5.13.4.a", "5.13.5", "5.13.5.a", "5.13.5.a.i", "5.13.5.a.ii", "5.13.5.b" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(2)", "4.1.44(1)", "4.1.44(2)", "4.1.44(2)(b)", "4.1.44(2)(c)", "4.1.44(2)(c)(i)", "4.1.44(2)(c)(ii)", "4.1.44(2)(d)", "4.2.63(1)", "4.2.63(1)(a)", "4.2.63(1)(b)", "4.2.63(1)(b)(i)", "4.2.63(1)(b)(ii)", "4.2.63(2)", "4.2.63(3)", "4.2.63(3)(a)", "4.2.63(3)(b)", "4.2.63(3)(c)", "4.2.64(1)", "4.2.64(1)(a)", "4.2.64(1)(b)", "4.2.64(1)(b)(i)", "4.2.64(1)(b)(ii)", "4.2.64(2)", "4.2.64(3)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4(b)", "P9-4.9.1", "P9-4.9.4", "P10-4.10.2", "P10-4.10.3", "P10-4.10.4" ] } }, { "principle_name": "Updating Personal Data", "description": "Provide data subjects with appropriate opportunity to correct or amend their personal data.", "scf_control": "Updating Personal Data (PD) Process", "scf_control_id": "PRI-08", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(a)(1)", "§ 164.526(b)(1)", "§ 164.526(e)", "§ 164.526(f)" ], "USA California CCPA 2025": [ "7023(b)", "7023(b)(1)", "7023(b)(1)(A)", "7023(b)(1)(B)", "7023(b)(1)(C)", "7023(b)(2)" ] } }, { "principle_name": "Updating Personal Data", "description": "Provide data subjects with appropriate opportunity to correct or amend their personal data.", "scf_control": "Updating & Correcting Personal Data (PD)", "scf_control_id": "PRI-08.1", "crosswalks": { "NIST 800-53 R5.2": [ "SI-18(04)", "SI-18(05)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(a)(1)", "§ 164.526(b)(1)" ], "USA California CCPA 2025": [ "7023(c)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.2" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(4)" ] } }, { "principle_name": "Redress", "description": "Provide data subjects with appropriate opportunity to challenge the organization's compliance with its data privacy principles.", "scf_control": "Correcting Inaccurate Personal Data (PD)", "scf_control_id": "PRI-39.3", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "A5.2", "A5.2-POF2" ], "APEC Privacy Framework 2015": [ "8(c)" ], "ISO 29100 2024": [ "6.9" ], "NIST 800-53 R5.2": [ "SI-18(04)", "SI-18(05)" ], "USA Federal Data Privacy Framework 2023": [ "II.6.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(a)(1)", "§ 164.526(a)(2)", "§ 164.526(a)(2)(i)", "§ 164.526(a)(2)(ii)", "§ 164.526(a)(2)(iii)", "§ 164.526(a)(2)(iv)", "§ 164.526(b)(1)" ], "USA Federal FIPPS 1973": [ "1" ], "USA California CCPA 2025": [ "7023(a)", "7023(b)", "7023(d)(1)", "7023(d)(2)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)(c)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(b)" ], "USA Oregon CPA 2023": [ "Section 3(1)(b)" ], "USA Oregon 646A 2025": [ "646A.574(1)(b)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(B)" ], "USA Texas CDPA 2025": [ "541.051(b)(2)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.2" ], "EMEA UK DPA 2018": [ "Section 46(1)", "Section 46(2)", "Section 46(3)", "Section 46(4)" ], "APAC Australian Privacy Principles 2026": [ "5.13.1", "5.13.1.a", "5.13.1.b", "5.13.1.b.i" ], "Americas Canada PIPEDA 2000": [ "P9-4.9.5" ] } }, { "principle_name": "Notice of Correction or Amendment", "description": "Notify affected data subjects and applicable third-parties when personal data is corrected or amended.", "scf_control": "Notice of Correction or Processing Change", "scf_control_id": "PRI-39.4", "crosswalks": { "NIST 800-53 R5.2": [ "SI-18(05)" ], "NIST Privacy Framework 1.0": [ "CT.PO-P4", "CM.PO-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.526(c)", "§ 164.526(c)(1)", "§ 164.526(c)(2)", "§ 164.526(c)(3)", "§ 164.526(c)(3)(i)", "§ 164.526(c)(3)(ii)" ], "USA California CCPA 2025": [ "7022(e)", "7023(f)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(b)(1)" ], "EMEA UK DPA 2018": [ "Section 48(1)", "Section 48(1)(a)", "Section 48(1)(b)", "Section 48(1)(b)(i)", "Section 48(1)(b)(ii)", "Section 48(1)(b)(iii)", "Section 48(1)(b)(iv)", "Section 48(2)", "Section 48(2)(a)", "Section 48(2)(b)", "Section 48(3)", "Section 48(3)(a)", "Section 48(3)(b)", "Section 48(3)(c)", "Section 48(3)(e)", "Section 48(4)", "Section 48(4)(a)", "Section 48(4)(b)", "Section 48(4)(c)", "Section 48(4)(d)", "Section 48(5)", "Section 48(6)", "Section 48(6)(a)", "Section 48(6)(b)", "Section 48(7)", "Section 48(9)", "Section 48(9)(a)", "Section 48(9)(b)", "Section 48(10)" ], "APAC Australian Privacy Principles 2026": [ "5.13.2", "5.13.2.a", "5.13.2.b", "5.13.3", "5.13.3.a", "5.13.3.b", "5.13.3.c" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(3)(b)" ] } }, { "principle_name": "Notice of Correction or Amendment", "description": "Notify affected data subjects and applicable third-parties when personal data is corrected or amended.", "scf_control": "Obligation To Inform Third-Parties", "scf_control_id": "PRI-42", "crosswalks": { "NIST Privacy Framework 1.0": [ "CM.AW-P5" ], "USA California CCPA 2025": [ "7022(b)(2)", "7022(b)(3)", "7022(f)(4)", "7023(c)", "7026(f)(2)", "7027(g)(2)", "7027(g)(3)" ], "USA Virginia CDPA 2023": [ "59.1-579.B.2" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.7(5)" ], "Americas Canada PIPEDA 2000": [ "P9-4.9.6" ] } }, { "principle_name": "Appeal", "description": "Provide data subjects with appropriate opportunity to appeal an adverse decision to have incorrect personal data amended.", "scf_control": "Appeal Adverse Decision", "scf_control_id": "PRI-39.5", "crosswalks": { "NIST 800-53 R5.2": [ "PM-26" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.524(d)(4)" ], "USA California CCPA 2025": [ "7023(d)(1)", "7023(f)(3)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(3)(a)" ], "USA Montana CDPA 2025": [ "30-14-2808(4)(b)", "30-14-2808(5)" ], "USA Nevada Privacy Law 2023": [ "603A.520.1", "603A.520.1(a)", "603A.520.1(b)", "603A.520.2", "603A.520.2(a)", "603A.520.2(b)", "603A.520.2(c)" ], "USA Oregon CPA 2023": [ "Section 4(6)(a)" ], "USA Oregon 646A 2025": [ "646A.576(6)", "646A.576(6)(a)", "646A.576(6)(b)", "646A.576(6)(c)", "646A.576(6)(d)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(c)" ], "USA Texas CDPA 2025": [ "541.053(a)" ], "USA Virginia CDPA 2023": [ "59.1-577.C" ] } }, { "principle_name": "Right to Erasure", "description": "Provide data subjects with appropriate opportunity to request the deletion of personal data where it is used, disseminated, maintained, retained and/or disclosed, including where the personal data is stored or processed by third-parties.", "scf_control": "Right to Erasure", "scf_control_id": "PRI-40", "crosswalks": { "USA California CCPA 2025": [ "7022(b)(1)", "7022(f)(2)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1306(1)(d)" ], "USA Montana CDPA 2025": [ "30-14-2808(1)(c)", "30-14-2808(4)(e)" ], "USA Nevada Privacy Law 2023": [ "603A.505.1(d)", "603A.515.1", "603A.515.1(a)", "603A.515.1(b)", "603A.515.2", "603A.515.3" ], "USA Oregon CPA 2023": [ "Section 3(1)(c)" ], "USA Oregon 646A 2025": [ "646A.574(1)(c)" ], "USA Tennessee TIPA 2025": [ "47-18-3203(a)(2)(C)", "47-18-3203(a)(2)(C)(i)(a)", "47-18-3203(a)(2)(C)(i)(b)", "47-18-3203(a)(2)(C)(ii)" ], "USA Texas CDPA 2025": [ "541.051(b)(3)" ], "USA Virginia CDPA 2023": [ "59.1-577.A.3" ], "EMEA EU GDPR 2016": [ "Article 17.1(a)", "Article 17.1(b)", "Article 17.1(c)", "Article 17.1(d)", "Article 17.1(e)", "Article 17.1(f)", "Article 17.2", "Article 17.3", "Article 17.3(a)", "Article 17.3(b)", "Article 17.3(c)", "Article 17.3(d)", "Article 17.3(e)" ], "EMEA UK DPA 2018": [ "Section 47(1)", "Section 47(1)(a)", "Section 47(1)(b)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Centralized Management of Security, Compliance & Resilience Controls", "scf_control_id": "GOV-03", "crosswalks": { "NIST 800-53 R5.2": [ "PL-09" ], "NIST CSF 2.0": [ "PR.IR" ], "NIST Privacy Framework 1.0": [ "GV.PO-P2" ], "USA California CCPA 2025": [ "7123(c)(5)(B)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Operationalizing Security, Compliance & Resilience Capabilities", "scf_control_id": "GOV-11", "crosswalks": { "ISO 27701 2025": [ "5.1" ], "ISO 29100 2024": [ "6.12" ], "NIST Privacy Framework 1.0": [ "GV.PO-P2" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)", "§ 164.306(b)(1)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7123(b)(3)" ], "USA Illinois IPA 2009": [ "35(c)", "37(c)" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Select Controls", "scf_control_id": "GOV-11.1", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Implement Controls", "scf_control_id": "GOV-11.2", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)", "§ 164.306(d)(3)(ii)(A)", "§ 164.308(a)(1)(ii)(B)" ], "USA Federal FIPPS 1973": [ "2" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Assess Controls", "scf_control_id": "GOV-11.3", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Authorize Technology Assets, Applications and/or Services (TAAS)", "scf_control_id": "GOV-11.4", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Monitor Controls", "scf_control_id": "GOV-11.5", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Identity & Access Management (IAM)", "scf_control_id": "IAC-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.1", "S7.1-POF2", "S7.1-POF3", "S7.1-POF6", "S7.1-POF7", "S7.1-POF8" ], "NIST 800-53 R5.2": [ "AC-01", "IA-01" ], "NIST CSF 2.0": [ "PR.AA", "PR.AA-05" ], "NIST Privacy Framework 1.0": [ "PR.AC-P", "PR.AC-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(i)", "§ 164.308(a)(4)(i)", "§ 164.308(a)(4)(ii)(B)", "§ 164.310(a)(2)(iii)", "§ 164.312(a)(1)", "§ 164.530(c)(2)(ii)" ], "USA California CCPA 2025": [ "7123(c)(1)", "7123(c)(3)", "7123(c)(3)(C)" ], "USA Vermont Act 171 2018": [ "2447(c)(1)" ], "Americas Canada PIPEDA 2000": [ "P7-4.7.3(b)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Continuous Monitoring", "scf_control_id": "MON-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.1-POF2" ], "NIST 800-53 R5.2": [ "AU-01", "PM-31", "SI-04" ], "NIST CSF 2.0": [ "PR.PS-04", "DE.CM-01", "DE.CM-03", "DE.CM-06", "DE.CM-09", "DE.AE" ], "NIST Privacy Framework 1.0": [ "CT.DM-P8" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(1)(i)", "§ 164.308(a)(1)(ii)(D)", "§ 164.312(b)" ], "USA California CCPA 2025": [ "7123(c)(7)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "scf_control_id": "MON-05", "crosswalks": { "NIST 800-53 R5.2": [ "AU-02", "AU-06", "IR-04(04)", "SI-04" ], "NIST CSF 2.0": [ "DE.AE-03", "DE.AE-06" ], "USA California CCPA 2025": [ "7123(c)(7)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Security of Personal Data (PD)", "scf_control_id": "PRI-10", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF6", "M1.4-POF1" ], "APEC Privacy Framework 2015": [ "7" ], "ISO 29100 2024": [ "6.11" ], "OECD Privacy Principles": [ "5" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal FIPPS 1973": [ "8" ], "USA California CCPA 2025": [ "7023(d)(4)", "7024(f)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(2)(a)", "6-1-1305(4)", "6-1-1308(5)" ], "USA Illinois BIPA 2008": [ "15(e)(1)", "15(e)(2)" ], "USA Illinois PIPA 2006": [ "45(a)" ], "USA Montana CDPA 2025": [ "30-14-2812(1)(b)", "30-14-2813(1)(b)", "30-14-2813(2)(a)", "30-14-2816(6)", "30-14-2818(1)(a)" ], "USA Nevada Privacy Law 2023": [ "603A.210.1" ], "USA Oregon CPA 2023": [ "Section 5(1)(c)", "Section 6(1)(b)" ], "USA Oregon 646A 2025": [ "646A.578(1)(c)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(3)" ], "USA Texas BC521 2009": [ "521.052(a)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.3", "59.1-579.A.1", "59.1-579.B.1" ], "USA Vermont Act 171 2018": [ "2447(a)(2)" ], "EMEA EU GDPR 2016": [ "Article 5.1(f)", "Article 24.1", "Article 25.1", "Article 25.2", "Article 32.1", "Article 32.1(a)", "Article 32.1(b)" ], "EMEA UK DPA 2018": [ "Section 55(3)", "Section 55(3)(a)", "Section 55(3)(b)", "Section 55(3)(c)", "Section 55(3)(d)", "Section 56(1)", "Section 56(2)", "Section 56(3)", "Section 57(1)", "Section 57(1)(a)", "Section 57(1)(b)", "Section 57(2)", "Section 57(3)", "Section 57(4)", "Section 57(4)(a)", "Section 57(4)(b)", "Section 57(4)(c)", "Section 57(4)(d)", "Section 57(5)", "Section 66(1)", "Section 66(2)", "Section 66(2)(a)", "Section 66(2)(b)", "Section 66(2)(c)", "Section 66(2)(d)", "Section 66(3)" ], "APAC Australian Privacy Principles 2026": [ "4.11.1", "4.11.1.a", "4.11.1.b" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.5(a)", "3.1.22.5(a)(i)", "3.1.22.5(a)(ii)", "3.1.22.5(a)(iii)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4(a)", "P7-4.7", "P7-4.7.1", "P7-4.7.2", "P7-4.7.3" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Technology Development & Acquisition", "scf_control_id": "TDA-02", "crosswalks": { "NIST 800-53 R5.2": [ "PL-01", "SA-01", "SA-04", "SA-23" ], "NIST CSF 2.0": [ "ID.RA-09", "PR.PS-06" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Secure by Design", "description": "Establish administrative, technical and physical safeguards to protect sensitive/regulated data commensurate with the risk and magnitude of the harm that would result from its unauthorized access, use, modification, loss or dissemination. Selected practices are in accordance with industry-leading practices (e.g., ISO 27002, NIST 800-53, Secure Controls Framework (SCF), etc.).", "scf_control": "Security, Compliance & Resilience Testing Throughout Development", "scf_control_id": "TDA-17", "crosswalks": { "NIST 800-53 R5.2": [ "SA-11", "SA-11(05)", "SA-11(06)", "SA-11(07)" ], "NIST CSF 2.0": [ "ID.RA-01", "ID.IM-01", "ID.IM-02", "PR.PS-06" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Configuration Change Control", "scf_control_id": "CHG-03", "crosswalks": { "NIST 800-53 R5.2": [ "CM-03", "SA-08(31)" ], "NIST CSF 2.0": [ "ID.RA-07" ], "NIST Privacy Framework 1.0": [ "PR.PO-P2" ], "USA California CCPA 2025": [ "7123(c)(4)(C)", "7123(c)(5)(D)", "7123(c)(5)(E)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Security Impact Analysis for Changes", "scf_control_id": "CHG-06", "crosswalks": { "NIST 800-53 R5.2": [ "CM-04" ], "NIST CSF 2.0": [ "ID.RA-07" ], "USA California CCPA 2025": [ "7123(c)(5)(D)", "7123(c)(5)(E)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Cloud Services", "scf_control_id": "CLD-02", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(5)(B)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Cloud Security Architecture", "scf_control_id": "CLD-05", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(5)(B)", "7123(c)(10)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Operationalizing Security, Compliance & Resilience Capabilities", "scf_control_id": "GOV-11", "crosswalks": { "ISO 27701 2025": [ "5.1" ], "ISO 29100 2024": [ "6.12" ], "NIST Privacy Framework 1.0": [ "GV.PO-P2" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)", "§ 164.306(b)(1)" ], "USA Federal FIPPS 1973": [ "2" ], "USA California CCPA 2025": [ "7123(b)(3)" ], "USA Illinois IPA 2009": [ "35(c)", "37(c)" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Select Controls", "scf_control_id": "GOV-11.1", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Implement Controls", "scf_control_id": "GOV-11.2", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)", "§ 164.306(d)(3)(ii)(A)", "§ 164.308(a)(1)(ii)(B)" ], "USA Federal FIPPS 1973": [ "2" ], "USA Nevada Privacy Law 2023": [ "603A.210.2", "603A.215.1" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Assess Controls", "scf_control_id": "GOV-11.3", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Authorize Technology Assets, Applications and/or Services (TAAS)", "scf_control_id": "GOV-11.4", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Monitor Controls", "scf_control_id": "GOV-11.5", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(1)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Authenticate, Authorize and Audit (AAA)", "scf_control_id": "IAC-03", "crosswalks": { "NIST 800-53 R5.2": [ "IA-04", "IA-04(04)" ], "NIST CSF 2.0": [ "PR.AA", "PR.AA-03", "PR.AA-04", "PR.AA-05" ], "USA California CCPA 2025": [ "7123(c)(1)(B)", "7123(c)(3)" ], "USA Vermont Act 171 2018": [ "2447(c)(1)(A)", "2447(c)(1)(B)", "2447(c)(2)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Role-Based Access Control (RBAC)", "scf_control_id": "IAC-06", "crosswalks": { "NIST 800-53 R5.2": [ "AC-02(07)" ], "NIST CSF 2.0": [ "PR.AA-05" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(i)", "§ 164.308(a)(3)(ii)(A)", "§ 164.308(a)(4)(ii)(C)", "§ 164.312(a)(1)", "§ 164.514(d)(2)(i)(A)", "§ 164.514(d)(2)(i)(B)", "§ 164.514(d)(2)(ii)", "§ 164.530(c)(2)(ii)" ], "USA California CCPA 2025": [ "7123(c)(3)(A)", "7123(c)(3)(A)(i)", "7123(c)(3)(A)(ii)", "7123(c)(3)(A)(iii)", "7123(c)(3)(B)" ], "USA Vermont Act 171 2018": [ "2447(c)(2)(A)", "2447(c)(2)(B)" ], "EMEA EU GDPR 2016": [ "Article 32.4" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Management Approval For New or Changed Accounts", "scf_control_id": "IAC-09", "crosswalks": { "NIST 800-53 R5.2": [ "AC-24", "IA-12(01)" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(ii)(A)" ], "USA California CCPA 2025": [ "7123(c)(3)(C)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Privileged Account Management (PAM)", "scf_control_id": "IAC-10", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(3)(B)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Least Privilege", "scf_control_id": "IAC-30", "crosswalks": { "NIST 800-53 R5.2": [ "AC-06", "SA-08(14)" ], "NIST CSF 2.0": [ "PR.AA-05", "PR.DS-10" ], "NIST Privacy Framework 1.0": [ "PR.AC-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(i)", "§ 164.312(a)(1)" ], "USA California CCPA 2025": [ "7123(c)(3)(A)", "7123(c)(3)(A)(iii)", "7123(c)(3)(B)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Multi-Factor Authentication (MFA)", "scf_control_id": "IAC-37", "crosswalks": { "NIST 800-53 R5.2": [ "IA-02(01)", "IA-02(02)" ], "USA California CCPA 2025": [ "7123(c)(1)(A)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Security of Personal Data (PD)", "scf_control_id": "PRI-10", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF6", "M1.4-POF1" ], "APEC Privacy Framework 2015": [ "7" ], "ISO 29100 2024": [ "6.11" ], "OECD Privacy Principles": [ "5" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal FIPPS 1973": [ "8" ], "USA California CCPA 2025": [ "7023(d)(4)", "7024(f)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(2)(a)", "6-1-1305(4)", "6-1-1308(5)" ], "USA Illinois BIPA 2008": [ "15(e)(1)", "15(e)(2)" ], "USA Illinois PIPA 2006": [ "45(a)" ], "USA Montana CDPA 2025": [ "30-14-2812(1)(b)", "30-14-2813(1)(b)", "30-14-2813(2)(a)", "30-14-2816(6)", "30-14-2818(1)(a)" ], "USA Nevada Privacy Law 2023": [ "603A.210.1" ], "USA Oregon CPA 2023": [ "Section 5(1)(c)", "Section 6(1)(b)" ], "USA Oregon 646A 2025": [ "646A.578(1)(c)" ], "USA Tennessee TIPA 2025": [ "47-18-3204(a)(3)" ], "USA Texas BC521 2009": [ "521.052(a)" ], "USA Virginia CDPA 2023": [ "59.1-578.A.3", "59.1-579.A.1", "59.1-579.B.1" ], "USA Vermont Act 171 2018": [ "2447(a)(2)" ], "EMEA EU GDPR 2016": [ "Article 5.1(f)", "Article 24.1", "Article 25.1", "Article 25.2", "Article 32.1", "Article 32.1(a)", "Article 32.1(b)" ], "EMEA UK DPA 2018": [ "Section 55(3)", "Section 55(3)(a)", "Section 55(3)(b)", "Section 55(3)(c)", "Section 55(3)(d)", "Section 56(1)", "Section 56(2)", "Section 56(3)", "Section 57(1)", "Section 57(1)(a)", "Section 57(1)(b)", "Section 57(2)", "Section 57(3)", "Section 57(4)", "Section 57(4)(a)", "Section 57(4)(b)", "Section 57(4)(c)", "Section 57(4)(d)", "Section 57(5)", "Section 66(1)", "Section 66(2)", "Section 66(2)(a)", "Section 66(2)(b)", "Section 66(2)(c)", "Section 66(2)(d)", "Section 66(3)" ], "APAC Australian Privacy Principles 2026": [ "4.11.1", "4.11.1.a", "4.11.1.b" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.5(a)", "3.1.22.5(a)(i)", "3.1.22.5(a)(ii)", "3.1.22.5(a)(iii)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4(a)", "P7-4.7", "P7-4.7.1", "P7-4.7.2", "P7-4.7.3" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Alignment With Enterprise Architecture", "scf_control_id": "SEA-04", "crosswalks": { "NIST 800-53 R5.2": [ "PL-08", "PM-07" ], "NIST CSF 2.0": [ "PR.IR", "PR.IR-01", "PR.IR-03" ], "NIST Privacy Framework 1.0": [ "GV.PO-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(1)", "§ 164.306(b)(2)(ii)" ], "USA California CCPA 2025": [ "7123(c)(5)(B)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Secure Engineering Principles", "scf_control_id": "SEA-05", "crosswalks": { "NIST 800-53 R5.2": [ "PT-01", "SA-08", "SA-15(05)", "SC-01", "SC-07(18)", "SI-01" ], "NIST CSF 2.0": [ "PR.IR", "PR.IR-01", "PR.IR-03" ], "NIST Privacy Framework 1.0": [ "ID.DE-P4", "GV.PO-P2", "CM.AW-P3", "PR.DS-P5" ], "USA Federal Data Privacy Framework 2023": [ "II.4.a" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(1)" ], "USA California CCPA 2025": [ "7123(c)(5)(B)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Development Methods, Techniques & Processes", "scf_control_id": "TDA-03", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04(03)", "SR-03(01)" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Secure Software Development Practices (SSDP)", "scf_control_id": "TDA-05", "crosswalks": { "NIST 800-53 R5.2": [ "SA-01", "SA-04(03)", "SA-15" ], "NIST CSF 2.0": [ "PR.PS-06" ], "NIST Privacy Framework 1.0": [ "CT.DP-P1" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Software Design Review", "scf_control_id": "TDA-05.4", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Product Management", "scf_control_id": "TDA-06", "crosswalks": { "NIST 800-53 R5.2": [ "SA-23" ], "NIST CSF 2.0": [ "GV.SC-09", "PR.PS-06" ], "NIST Privacy Framework 1.0": [ "CT.DP-P1" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Ongoing Product Security Support", "scf_control_id": "TDA-06.3", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Disclosure of Vulnerabilities", "scf_control_id": "TDA-07", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(6)", "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Technical Documentation Artifacts", "scf_control_id": "TDA-08", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Insecure Ports, Protocols & Services", "scf_control_id": "TDA-11.2", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Minimizing Attack Surfaces", "scf_control_id": "TDA-13", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Pre-Established Secure Configurations", "scf_control_id": "TDA-13.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04(05)" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Product Testing & Reviews", "scf_control_id": "TDA-14", "crosswalks": { "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cybersecurity Considerations", "description": "Incorporate cybersecurity requirements into enterprise architecture to ensure that risk is addressed so Technology Assets, Applications and/or Services (TAAS) achieve the necessary levels of trustworthiness, protection and resilience.", "scf_control": "Security, Compliance & Resilience Representatives For Product Changes", "scf_control_id": "TDA-14.1", "crosswalks": { "NIST 800-53 R5.2": [ "SA-10(07)" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Cryptographic Protections", "description": "Ensure personal data is encrypted both at rest and in transit.", "scf_control": "Use of Cryptographic Controls", "scf_control_id": "CRY-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.1-POF9" ], "NIST 800-53 R5.2": [ "SC-08(01)", "SC-08(02)", "SC-13", "SI-07(06)" ], "NIST CSF 2.0": [ "PR.DS-01", "PR.DS-02", "PR.DS-10" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(a)(2)(iv)", "§ 164.312(e)(2)(ii)" ], "USA California CCPA 2025": [ "7123(c)(2)" ], "EMEA EU GDPR 2016": [ "Article 32.1(a)" ] } }, { "principle_name": "Cryptographic Protections", "description": "Ensure personal data is encrypted both at rest and in transit.", "scf_control": "Encrypting Data In Transit", "scf_control_id": "CRY-05", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.3-POF2" ], "NIST 800-53 R5.2": [ "SC-08", "SC-08(01)" ], "NIST CSF 2.0": [ "PR.DS-02" ], "NIST Privacy Framework 1.0": [ "PR.DS-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(e)(1)" ], "USA California CCPA 2025": [ "7123(c)(2)" ], "USA Nevada Privacy Law 2023": [ "603A.215.2(a)" ], "USA Vermont Act 171 2018": [ "2447(c)(3)" ] } }, { "principle_name": "Cryptographic Protections", "description": "Ensure personal data is encrypted both at rest and in transit.", "scf_control": "Encrypting Data At Rest", "scf_control_id": "CRY-07", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.3-POF2" ], "NIST 800-53 R5.2": [ "SC-13", "SC-28", "SC-28(01)" ], "NIST CSF 2.0": [ "PR.DS-01" ], "NIST Privacy Framework 1.0": [ "PR.DS-P1" ], "USA California CCPA 2025": [ "7123(c)(2)" ], "USA Vermont Act 171 2018": [ "2447(c)(5)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Physical & Environmental Protections", "scf_control_id": "PES-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.1-POF2", "S7.1-POF6" ], "NIST 800-53 R5.2": [ "PE-01", "PE-23" ], "NIST CSF 2.0": [ "ID.AM", "PR.AA", "PR.AA-06", "PR.IR-02", "DE.CM-02" ], "NIST Privacy Framework 1.0": [ "PR.PO-P4", "PR.AC-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(a)(1)", "§ 164.310(a)(2)(ii)", "§ 164.310(a)(2)(iv)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ], "Americas Canada PIPEDA 2000": [ "P7-4.7.3(a)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Physical Access Authorizations", "scf_control_id": "PES-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.2-POF1", "S7.2-POF3" ], "NIST 800-53 R5.2": [ "PE-02" ], "NIST CSF 2.0": [ "PR.AA", "PR.AA-06" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(a)(2)(i)", "§ 164.310(a)(2)(iii)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Role-Based Physical Access", "scf_control_id": "PES-07", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.2", "S7.2-POF3" ], "NIST 800-53 R5.2": [ "PE-02(01)" ], "NIST CSF 2.0": [ "PR.AA-06" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(a)(2)(i)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Physical Access Control", "scf_control_id": "PES-08", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.2", "S7.2-POF4", "S7.2-POF5" ], "NIST 800-53 R5.2": [ "PE-03", "PE-03(02)", "PE-03(03)" ], "NIST CSF 2.0": [ "PR.AA", "PR.AA-06", "DE.CM-02" ], "NIST Privacy Framework 1.0": [ "PR.AC-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(a)(2)(ii)", "§ 164.310(a)(2)(iii)", "§ 164.310(c)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ], "USA Vermont Act 171 2018": [ "2447(b)(7)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Physical Security of Offices, Rooms & Facilities", "scf_control_id": "PES-10", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.2-POF5" ], "NIST Privacy Framework 1.0": [ "PR.AC-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(b)", "§ 164.310(c)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Monitoring Physical Access", "scf_control_id": "PES-13", "crosswalks": { "NIST 800-53 R5.2": [ "PE-06" ], "NIST CSF 2.0": [ "DE.CM-02" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ] } }, { "principle_name": "Physical Protections", "description": "Ensure physical security and environmental controls provide appropriate protection for environments where personal data is stored, transmitted and/or processed.", "scf_control": "Visitor Control", "scf_control_id": "PES-14", "crosswalks": { "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(a)(2)(iii)" ], "USA California CCPA 2025": [ "7123(c)(3)(D)" ] } }, { "principle_name": "Embedded Technology", "description": "Facilitate the secure implementation of embedded technologies so sensors minimize the collection of personal data and alert data subjects to the personal data collected by those sensors.", "scf_control": "Embedded Sensor Data Use Restrictions", "scf_control_id": "CFG-18.1", "crosswalks": { "NIST 800-53 R5.2": [ "SC-42(02)" ] } }, { "principle_name": "Embedded Technology", "description": "Facilitate the secure implementation of embedded technologies so sensors minimize the collection of personal data and alert data subjects to the personal data collected by those sensors.", "scf_control": "Notice of Embedded Sensor Data Collection", "scf_control_id": "CFG-18.2", "crosswalks": { "NIST 800-53 R5.2": [ "SC-42(04)" ] } }, { "principle_name": "Embedded Technology", "description": "Facilitate the secure implementation of embedded technologies so sensors minimize the collection of personal data and alert data subjects to the personal data collected by those sensors.", "scf_control": "Embedded Sensor Data Collection Minimization", "scf_control_id": "CFG-18.3", "crosswalks": { "NIST 800-53 R5.2": [ "PM-25", "SA-08(33)", "SC-42(05)" ] } }, { "principle_name": "Embedded Technology", "description": "Facilitate the secure implementation of embedded technologies so sensors minimize the collection of personal data and alert data subjects to the personal data collected by those sensors.", "scf_control": "Embedded Technology Security Program", "scf_control_id": "EMB-02", "crosswalks": {} }, { "principle_name": "Retire Outdated Systems", "description": "Upgrade, replace, or retire any system, application or service for which appropriate protections, commensurate with risk, cannot be effectively implemented.", "scf_control": "Unsupported Technology Assets, Applications and/or Services (TAAS)", "scf_control_id": "AST-39", "crosswalks": { "NIST 800-53 R5.2": [ "SA-22" ], "NIST CSF 2.0": [ "PR.PS-02", "PR.PS-03" ] } }, { "principle_name": "Personnel Security", "description": "Implement personnel management practices, covering employees, contractors and other entities, that ensures appropriate vetting and clearance to Technology Assets, Applications and/or Services (TAAS) that contain, store or transmit personal data.", "scf_control": "Human Resources Security Management", "scf_control_id": "HRS-02", "crosswalks": { "ISO 27701 2025": [ "7.2" ], "NIST 800-53 R5.2": [ "PS-01" ], "NIST CSF 2.0": [ "GV.RR-04", "ID.AM" ], "NIST Privacy Framework 1.0": [ "PR.PO-P9" ], "USA Federal Data Privacy Framework 2023": [ "III.9.b.iii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(ii)(A)", "§ 164.312(d)", "§ 164.530(e)(2)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Rules of Behavior", "description": "Require employees and contractors to read and agree to abide by the organization's rules of behavior, prior to being granted access to Technology Assets, Applications and/or Services (TAAS) that store, transmit or process personal data, including social media.", "scf_control": "Rules of Behavior", "scf_control_id": "HRS-06.1", "crosswalks": { "NIST 800-53 R5.2": [ "PL-04" ], "NIST CSF 2.0": [ "ID.AM" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.310(b)" ] } }, { "principle_name": "Rules of Behavior", "description": "Require employees and contractors to read and agree to abide by the organization's rules of behavior, prior to being granted access to Technology Assets, Applications and/or Services (TAAS) that store, transmit or process personal data, including social media.", "scf_control": "Social Media & Social Networking Restrictions", "scf_control_id": "HRS-06.2", "crosswalks": { "NIST 800-53 R5.2": [ "PL-04(01)" ] } }, { "principle_name": "Employee Sanctions", "description": "Utilize employee sanctions to hold personnel accountable for complying with the organization's data privacy policies and processes.", "scf_control": "Personnel Sanctions", "scf_control_id": "HRS-10", "crosswalks": { "NIST 800-53 R5.2": [ "PS-08" ], "NIST CSF 2.0": [ "GV.PO", "GV.PO-01", "GV.PO-02" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(1)(ii)(C)", "§ 164.530(e)(1)" ], "USA Vermont Act 171 2018": [ "2447(b)(4)" ] } }, { "principle_name": "Workforce Management", "description": "Respond to changing mission requirements and maintain workforce skills in a rapidly-developing technology environment through recruiting and retaining the talent needed to support the organization's mission.", "scf_control": "Human Resources Security Management", "scf_control_id": "HRS-02", "crosswalks": { "ISO 27701 2025": [ "7.2" ], "NIST 800-53 R5.2": [ "PS-01" ], "NIST CSF 2.0": [ "GV.RR-04", "ID.AM" ], "NIST Privacy Framework 1.0": [ "PR.PO-P9" ], "USA Federal Data Privacy Framework 2023": [ "III.9.b.iii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(3)(ii)(A)", "§ 164.312(d)", "§ 164.530(e)(2)" ], "USA Federal FIPPS 1973": [ "2" ] } }, { "principle_name": "Workforce Management", "description": "Respond to changing mission requirements and maintain workforce skills in a rapidly-developing technology environment through recruiting and retaining the talent needed to support the organization's mission.", "scf_control": "Security, Compliance & Resilience-Minded Workforce", "scf_control_id": "SAT-02", "crosswalks": { "NIST 800-53 R5.2": [ "AT-01", "PM-13" ], "NIST CSF 2.0": [ "PR.AT" ], "NIST Privacy Framework 1.0": [ "GV.AT-P", "GV.AT-P1", "GV.AT-P2", "GV.AT-P3", "GV.AT-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(5)(i)" ], "USA California CCPA 2025": [ "7123(c)(12)" ] } }, { "principle_name": "Professional Competency", "description": "Develop and enforce data privacy competency requirements for staff members involved in the acquisition, management, maintenance and use of information resources, to ensure they have the appropriate knowledge and skill.", "scf_control": "Competency Requirements for Security, Compliance & Resilience-Related Positions", "scf_control_id": "HRS-03.2", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF4" ], "ISO 27701 2025": [ "7.2" ], "NIST 800-53 R5.2": [ "PS-02" ] } }, { "principle_name": "Professional Competency", "description": "Develop and enforce data privacy competency requirements for staff members involved in the acquisition, management, maintenance and use of information resources, to ensure they have the appropriate knowledge and skill.", "scf_control": "Personnel Screening", "scf_control_id": "HRS-05", "crosswalks": { "NIST 800-53 R5.2": [ "PS-03" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(d)" ] } }, { "principle_name": "Cybersecurity & Data Privacy Control Validation", "description": "Develop and enforce an Information Assurance (IA) capability that provides a mechanism to perform pre-production control testing to ensure applicable cybersecurity & data privacy controls exist and are functioning. Systems, applications and service are prohibited from \"going live\" without security authorization, following the results of pre-production control testing.", "scf_control": "Information Assurance (IA) Operations", "scf_control_id": "IAO-02", "crosswalks": { "NIST 800-53 R5.2": [ "CA-01", "PM-10" ], "NIST CSF 2.0": [ "ID.RA-01" ], "USA California CCPA 2025": [ "7123(c)(4)(C)" ] } }, { "principle_name": "Cybersecurity & Data Privacy Control Validation", "description": "Develop and enforce an Information Assurance (IA) capability that provides a mechanism to perform pre-production control testing to ensure applicable cybersecurity & data privacy controls exist and are functioning. Systems, applications and service are prohibited from \"going live\" without security authorization, following the results of pre-production control testing.", "scf_control": "Security Authorization", "scf_control_id": "IAO-14", "crosswalks": { "NIST 800-53 R5.2": [ "CA-06" ], "USA California CCPA 2025": [ "7123(c)(4)(C)" ] } }, { "principle_name": "Cybersecurity & Data Privacy Control Validation", "description": "Develop and enforce an Information Assurance (IA) capability that provides a mechanism to perform pre-production control testing to ensure applicable cybersecurity & data privacy controls exist and are functioning. Systems, applications and service are prohibited from \"going live\" without security authorization, following the results of pre-production control testing.", "scf_control": "Risk Monitoring", "scf_control_id": "RSK-22", "crosswalks": { "NIST 800-53 R5.2": [ "CA-07(04)" ] } }, { "principle_name": "Cybersecurity & Data Privacy Control Validation", "description": "Develop and enforce an Information Assurance (IA) capability that provides a mechanism to perform pre-production control testing to ensure applicable cybersecurity & data privacy controls exist and are functioning. Systems, applications and service are prohibited from \"going live\" without security authorization, following the results of pre-production control testing.", "scf_control": "Security, Compliance & Resilience Testing Throughout Development", "scf_control_id": "TDA-17", "crosswalks": { "NIST 800-53 R5.2": [ "SA-11", "SA-11(05)", "SA-11(06)", "SA-11(07)" ], "NIST CSF 2.0": [ "ID.RA-01", "ID.IM-01", "ID.IM-02", "PR.PS-06" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Secure Configuration Management", "description": "Implement secure configuration management throughout the System Development Life Cycle (SDLC) to ensure Technology Assets, Applications and/or Services (TAAS) are configured according to industry-recognized secure practices.", "scf_control": "Configuration Management Program", "scf_control_id": "CFG-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.1-POF8" ], "NIST 800-53 R5.2": [ "CM-01", "CM-09" ], "NIST CSF 2.0": [ "PR.PS", "PR.PS-01", "PR.PS-05" ], "NIST Privacy Framework 1.0": [ "PR.PO-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(1)(i)" ], "USA California CCPA 2025": [ "7123(c)(4)(B)", "7123(c)(5)", "7123(c)(11)" ], "Americas Canada PIPEDA 2000": [ "P7-4.7.3(c)" ] } }, { "principle_name": "Secure Configuration Management", "description": "Implement secure configuration management throughout the System Development Life Cycle (SDLC) to ensure Technology Assets, Applications and/or Services (TAAS) are configured according to industry-recognized secure practices.", "scf_control": "Secure Baseline Configurations", "scf_control_id": "CFG-04", "crosswalks": { "NIST 800-53 R5.2": [ "CM-02", "CM-06", "PL-10", "SA-08", "SA-15(05)" ], "NIST CSF 2.0": [ "PR.DS-10", "PR.PS", "PR.PS-05" ], "NIST Privacy Framework 1.0": [ "CT.DP-P4", "PR.PO-P1", "PR.PT-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(a)(2)(iii)", "§ 164.312(e)(1)", "§ 164.312(e)(2)(i)", "§ 164.312(e)(2)(ii)" ], "USA California CCPA 2025": [ "7123(c)(4)(B)", "7123(c)(5)", "7123(c)(5)(A)", "7123(c)(5)(B)", "7123(c)(11)" ] } }, { "principle_name": "Secure Configuration Management", "description": "Implement secure configuration management throughout the System Development Life Cycle (SDLC) to ensure Technology Assets, Applications and/or Services (TAAS) are configured according to industry-recognized secure practices.", "scf_control": "Security, Compliance & Resilience Testing Throughout Development", "scf_control_id": "TDA-17", "crosswalks": { "NIST 800-53 R5.2": [ "SA-11", "SA-11(05)", "SA-11(06)", "SA-11(07)" ], "NIST CSF 2.0": [ "ID.RA-01", "ID.IM-01", "ID.IM-02", "PR.PS-06" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Situational Awareness", "description": "Correlate logs from across the organization with a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness of events for potential cybersecurity & data privacy incidents.", "scf_control": "System Generated Event Logs & Security-Relevant Telemetry", "scf_control_id": "MON-04", "crosswalks": { "NIST 800-53 R5.2": [ "SI-04(05)", "SI-04(17)" ], "NIST CSF 2.0": [ "PR.PS-04", "DE.CM-01" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.312(b)" ], "USA California CCPA 2025": [ "7123(c)(7)" ] } }, { "principle_name": "Situational Awareness", "description": "Correlate logs from across the organization with a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness of events for potential cybersecurity & data privacy incidents.", "scf_control": "Centralized Collection of Event Logs & Security-Relevant Telemetry", "scf_control_id": "MON-05", "crosswalks": { "NIST 800-53 R5.2": [ "AU-02", "AU-06", "IR-04(04)", "SI-04" ], "NIST CSF 2.0": [ "DE.AE-03", "DE.AE-06" ], "USA California CCPA 2025": [ "7123(c)(7)" ] } }, { "principle_name": "Situational Awareness", "description": "Correlate logs from across the organization with a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness of events for potential cybersecurity & data privacy incidents.", "scf_control": "Automated Tools for Real-Time Event Log & Security-Relevant Telemetry Analysis", "scf_control_id": "MON-05.4", "crosswalks": { "NIST 800-53 R5.2": [ "SC-48", "SI-04(02)" ], "USA California CCPA 2025": [ "7123(c)(8)(A)" ] } }, { "principle_name": "Situational Awareness", "description": "Correlate logs from across the organization with a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness of events for potential cybersecurity & data privacy incidents.", "scf_control": "Correlate Monitoring Information", "scf_control_id": "MON-08", "crosswalks": { "NIST 800-53 R5.2": [ "AU-06(03)", "AU-06(09)", "IR-04(04)", "SI-04(16)" ], "NIST CSF 2.0": [ "DE.AE-03", "DE.AE-06" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Incident Response Operations", "scf_control_id": "IRO-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3-POF3" ], "NIST 800-53 R5.2": [ "IR-01" ], "NIST CSF 2.0": [ "GV.SC-08", "DE.AE", "RS", "RS.MI" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(1)(i)", "§ 164.308(a)(6)(i)", "§ 164.308(a)(7)(i)" ], "USA California CCPA 2025": [ "7123(c)(17)", "7123(c)(17)(B)" ], "USA Illinois PIPA 2006": [ "12(g)", "12(g)(i)", "12(g)(ii)", "12(g)(iii)", "12(g)(iv)", "12(g)(v)" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Incident Handling", "scf_control_id": "IRO-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3-POF3" ], "NIST 800-53 R5.2": [ "IR-04" ], "NIST CSF 2.0": [ "GV.SC-08", "DE.AE", "DE.AE-02", "DE.AE-03", "DE.AE-04", "DE.AE-06", "DE.AE-08", "RS", "RS.MA", "RS.MA-01", "RS.MA-02", "RS.MA-04", "RS.AN", "RS.AN-06", "RS.CO", "RS.CO-02", "RS.CO-03", "RS.MI", "RS.MI-01", "RS.MI-02", "RC.RP-06" ], "NIST Privacy Framework 1.0": [ "GV.MT-P5" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(6)(ii)", "§ 164.412", "§ 164.412(a)", "§ 164.412(b)", "§ 164.530(f)" ], "USA California CCPA 2025": [ "7027(m)(2)", "7123(c)(17)(B)(i)" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Incident Response Plan (IRP)", "scf_control_id": "IRO-08", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3-POF3" ], "NIST 800-53 R5.2": [ "IR-08" ], "NIST CSF 2.0": [ "ID.IM-04", "DE.AE-06", "RS", "RS.MA", "RS.MA-01", "RS.MA-02", "RS.MA-04", "RS.MI" ], "NIST Privacy Framework 1.0": [ "PR.PO-P7" ], "USA California CCPA 2025": [ "7123(c)(17)(B)(i)" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Incident Response Capabilities Testing", "scf_control_id": "IRO-09", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.5-POF2" ], "NIST 800-53 R5.2": [ "IR-03", "IR-03(01)", "IR-03(03)", "SI-04(09)" ], "NIST Privacy Framework 1.0": [ "PR.PO-P8" ], "USA California CCPA 2025": [ "7123(c)(17)(B)(ii)" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Incident Reporting Assistance", "scf_control_id": "IRO-18", "crosswalks": { "NIST 800-53 R5.2": [ "IR-07" ] } }, { "principle_name": "Incident Response", "description": "Maintain and test incident response plans, capabilities and training for employees and third-party stakeholders on how to report and respond to incidents.", "scf_control": "Data Breach", "scf_control_id": "IRO-22", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.6", "D6.6-POF2" ], "NIST 800-53 R5.2": [ "IR-08(01)" ], "NIST Privacy Framework 1.0": [ "CM.AW-P7", "CM.AW-P8" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.404(a)(1)", "§ 164.404(a)(2)", "§ 164.404(c)(1)(A)", "§ 164.404(c)(1)(B)", "§ 164.404(c)(1)(C)", "§ 164.404(c)(1)(D)", "§ 164.404(c)(1)(E)", "§ 164.404(c)(2)", "§ 164.404(d)(1)(i)", "§ 164.404(d)(1)(ii)", "§ 164.404(d)(2)", "§ 164.404(d)(2)(i)", "§ 164.404(d)(2)(ii)(A)", "§ 164.404(d)(2)(ii)(B)", "§ 164.404(d)(3)", "§ 164.406(a)", "§ 164.406(b)", "§ 164.406(c)", "§ 164.410(c)(1)" ], "USA Montana CDPA 2025": [ "30-14-2813(1)(b)" ], "EMEA EU GDPR 2016": [ "Article 33.1" ] } }, { "principle_name": "Coordinated Response", "description": "Respond to incidents in a coordinated and structed manner to ensure the appropriate steps are taken to identify and respond to potential incidents.", "scf_control": "Incident Handling", "scf_control_id": "IRO-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3-POF3" ], "NIST 800-53 R5.2": [ "IR-04" ], "NIST CSF 2.0": [ "GV.SC-08", "DE.AE", "DE.AE-02", "DE.AE-03", "DE.AE-04", "DE.AE-06", "DE.AE-08", "RS", "RS.MA", "RS.MA-01", "RS.MA-02", "RS.MA-04", "RS.AN", "RS.AN-06", "RS.CO", "RS.CO-02", "RS.CO-03", "RS.MI", "RS.MI-01", "RS.MI-02", "RC.RP-06" ], "NIST Privacy Framework 1.0": [ "GV.MT-P5" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(6)(ii)", "§ 164.412", "§ 164.412(a)", "§ 164.412(b)", "§ 164.530(f)" ], "USA California CCPA 2025": [ "7027(m)(2)", "7123(c)(17)(B)(i)" ] } }, { "principle_name": "Coordinated Response", "description": "Respond to incidents in a coordinated and structed manner to ensure the appropriate steps are taken to identify and respond to potential incidents.", "scf_control": "Integrated Security Incident Response Team (ISIRT)", "scf_control_id": "IRO-11", "crosswalks": { "NIST 800-53 R5.2": [ "IR-04(11)" ], "NIST CSF 2.0": [ "DE.AE-06", "RS", "RS.MA", "RS.MA-01", "RS.MA-04" ] } }, { "principle_name": "Breach Notification", "description": "Report data breaches involving personal data to relevant regulators, law enforcement and affected parties in accordance with applicable statutory, regulatory and contractual obligations for breach notification.", "scf_control": "Incident Stakeholder Reporting", "scf_control_id": "IRO-16", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.6", "D6.6-POF2" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "IR-06" ], "NIST CSF 2.0": [ "DE.AE-06", "RS", "RS.MA-01", "RS.CO", "RS.CO-02", "RS.CO-03" ], "NIST Privacy Framework 1.0": [ "CM.AW-P7" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.404(b)", "§ 164.408(a)", "§ 164.408(b)", "§ 164.408(c)" ], "USA Illinois PIPA 2006": [ "10(a)", "10(a)(1)", "10(a)(1)(A)", "10(a)(1)(B)", "10(a)(1)(C)", "10(a)(2)", "10(b)", "10(b-5)", "10(c)", "10(c)(1)", "10(c)(2)", "10(c)(3)", "10(d)", "10(e)(2)", "10(e)(2)(A)", "10(e)(2)(B)", "10(e)(2)(C)", "12(a)", "12(a)(1)", "12(a)(1)(i)", "12(a)(1)(ii)", "12(a)(1)(iii)", "12(a)(2)", "12(a-5)", "12(b)", "12(b)(1)", "12(b)(2)", "12(b)(3)", "12(b)(3)(i)", "12(b)(3)(ii)", "12(b)(3)(iii)", "12(c)", "12(d)", "12(e)", "12(e)(A)", "12(e)(B)", "12(e)(C)", "12(e)(D)" ], "USA Nevada Privacy Law 2023": [ "603A.220.1", "603A.220.2", "603A.220.3", "603A.220.4", "603A.220.4(a)", "603A.220.4(b)", "603A.220.4(c)", "603A.220.4(c)(1)", "603A.220.4(c)(2)", "603A.220.4(c)(3)", "603A.220.6" ], "USA Texas BC521 2009": [ "521.053(b)", "521.053(b-1)", "521.053(c)", "521.053(d)", "521.053(e)", "521.053(e)(1)", "521.053(e)(2)", "521.053(e)(3)", "521.053(f)", "521.053(f)(1)", "521.053(f)(2)", "521.053(f)(3)", "521.053(g)", "521.053(h)", "521.053(i)", "521.053(i)(1)", "521.053(i)(2)", "521.053(i)(3)", "521.053(i)(4)", "521.053(i)(5)", "521.053(i)(6)" ], "EMEA EU GDPR 2016": [ "Article 34.1", "Article 34.2" ], "EMEA UK DPA 2018": [ "Section 67(1)", "Section 67(1)(a)", "Section 67(1)(b)", "Section 67(2)", "Section 67(3)", "Section 67(4)", "Section 67(4)(a)", "Section 67(4)(b)", "Section 67(4)(c)", "Section 67(4)(d)", "Section 67(5)", "Section 67(6)", "Section 67(6)(a)", "Section 67(6)(b)", "Section 67(6)(c)", "Section 67(7)", "Section 67(9)", "Section 68(1)", "Section 68(2)", "Section 68(2)(a)", "Section 68(2)(b)", "Section 68(2)(c)", "Section 68(2)(d)", "Section 68(3)", "Section 68(3)(a)", "Section 68(3)(b)", "Section 68(3)(c)", "Section 68(4)", "Section 68(5)", "Section 68(6)", "Section 68(6)(a)", "Section 68(6)(b)", "Section 68(7)", "Section 68(7)(a)", "Section 68(7)(b)", "Section 68(7)(c)", "Section 68(7)(e)", "Section 68(8)", "Section 68(9)" ], "APAC New Zealand Privacy Act of 2020": [ "6.1.115(1)", "6.1.115(2)", "6.1.115(3)", "6.1.115(3)(a)", "6.1.115(3)(b)", "6.1.115(4)", "6.1.115(4)(a)", "6.1.115(4)(b)", "6.1.117(1)", "6.1.117(1)(a)", "6.1.117(1)(a)(i)", "6.1.117(1)(a)(ii)", "6.1.117(1)(b)", "6.1.117(1)(c)", "6.1.117(1)(d)", "6.1.117(1)(e)", "6.1.117(1)(f)", "6.1.117(2)", "6.1.117(2)(a)", "6.1.117(2)(b)", "6.1.117(2)(c)", "6.1.117(2)(d)", "6.1.117(2)(e)", "6.1.117(2)(f)", "6.1.117(3)", "6.1.117(4)", "6.1.117(5)" ] } }, { "principle_name": "Breach Notification", "description": "Report data breaches involving personal data to relevant regulators, law enforcement and affected parties in accordance with applicable statutory, regulatory and contractual obligations for breach notification.", "scf_control": "Coordination With External Providers", "scf_control_id": "IRO-19.1", "crosswalks": { "NIST 800-53 R5.2": [ "IR-07(02)" ] } }, { "principle_name": "Risk Management", "description": "Implement a risk management framework to ensure that risks are identified, evaluated and addressed to achieve necessary levels of trustworthiness, protection and resilience.", "scf_control": "Risk Management Program", "scf_control_id": "RSK-02", "crosswalks": { "ISO 27701 2025": [ "6.1.2" ], "NIST 800-53 R5.2": [ "PM-09", "PM-29", "RA-01" ], "NIST CSF 2.0": [ "GV", "GV.RM", "GV.RM-01", "GV.RM-03", "GV.RM-04", "GV.RM-06", "GV.RR-01", "GV.OV-02", "GV.OV-03", "GV.SC", "GV.SC-01", "GV.SC-03", "GV.SC-05", "GV.SC-09", "ID", "ID.RA", "ID.IM", "PR", "PR.IR" ], "NIST Privacy Framework 1.0": [ "ID.RA-P", "ID.DE-P", "ID.DE-P1", "GV.PO-P6", "GV.RM-P", "GV.RM-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(a)(3)", "§ 164.306(b)(2)(iv)" ], "USA Vermont Act 171 2018": [ "2447(b)(2)" ], "EMEA EU GDPR 2016": [ "Article 32.2" ] } }, { "principle_name": "Risk Management", "description": "Implement a risk management framework to ensure that risks are identified, evaluated and addressed to achieve necessary levels of trustworthiness, protection and resilience.", "scf_control": "Compensating Countermeasures", "scf_control_id": "RSK-18", "crosswalks": { "ISO 27701 2025": [ "6.1.3" ], "NIST 800-53 R5.2": [ "CP-13" ], "NIST CSF 2.0": [ "GV.RM-04", "ID.RA-06" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(d)(3)(ii)(B)(2)" ], "USA California CCPA 2025": [ "7002(d)(3)" ] } }, { "principle_name": "Risk Management", "description": "Implement a risk management framework to ensure that risks are identified, evaluated and addressed to achieve necessary levels of trustworthiness, protection and resilience.", "scf_control": "Risk Monitoring", "scf_control_id": "RSK-22", "crosswalks": { "NIST 800-53 R5.2": [ "CA-07(04)" ] } }, { "principle_name": "Evaluate Risks", "description": "Utilize appropriate risk analysis methods to evaluate the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of personal data where it is stored, transmitted and/or processed.", "scf_control": "Risk Assessment", "scf_control_id": "RSK-13", "crosswalks": { "ISO 27701 2025": [ "6.1.2(e)" ], "NIST 800-53 R5.2": [ "RA-03" ], "NIST CSF 2.0": [ "GV.RM-06", "ID", "ID.RA-01", "ID.RA-05" ], "NIST Privacy Framework 1.0": [ "ID.DE-P5", "GV.MT-P1" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(2)(iv)", "§ 164.308(a)(1)(ii)(A)" ], "USA California CCPA 2025": [ "7152(a)", "7155(a)" ], "USA Montana CDPA 2025": [ "30-14-2811(1)(a)" ] } }, { "principle_name": "Evaluate Risks", "description": "Utilize appropriate risk analysis methods to evaluate the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of personal data where it is stored, transmitted and/or processed.", "scf_control": "Instances Requiring A Risk Assessment", "scf_control_id": "RSK-13.1", "crosswalks": { "USA California CCPA 2025": [ "7150(a)", "7150(b)", "7150(b)(1)", "7150(b)(2)", "7150(b)(2)(A)", "7150(b)(3)", "7150(b)(4)", "7150(b)(5)", "7150(b)(6)", "7155(a)(1)", "7155(a)(2)", "7155(a)(3)", "7155(b)" ], "USA Montana CDPA 2025": [ "30-14-2814(1)", "30-14-2819(1)" ] } }, { "principle_name": "Evaluate Risks", "description": "Utilize appropriate risk analysis methods to evaluate the likelihood and magnitude of harm, from unauthorized access, use, disclosure, disruption, modification or destruction of personal data where it is stored, transmitted and/or processed.", "scf_control": "Risk Assessment Stakeholder Involvement", "scf_control_id": "RSK-13.3", "crosswalks": { "USA California CCPA 2025": [ "7151(a)", "7151(b)" ] } }, { "principle_name": "Assess Supply Chain Risk", "description": "Assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS) for data privacy implications.", "scf_control": "Business Impact Analysis (BIA)", "scf_control_id": "RSK-08", "crosswalks": {} }, { "principle_name": "Assess Supply Chain Risk", "description": "Assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS) for data privacy implications.", "scf_control": "Supply Chain Risk Management (SCRM) Plan", "scf_control_id": "RSK-20", "crosswalks": { "NIST 800-53 R5.2": [ "PM-29", "PM-30", "SA-09(03)", "SR-02", "SR-07" ], "NIST CSF 2.0": [ "GV.SC", "GV.SC-01", "GV.SC-03", "GV.SC-05", "GV.SC-09", "GV.SC-10", "ID", "ID.RA", "ID.IM", "PR" ], "NIST Privacy Framework 1.0": [ "ID.DE-P2", "ID.DE-P3" ] } }, { "principle_name": "Assess Supply Chain Risk", "description": "Assess supply chain risks associated with Technology Assets, Applications and/or Services (TAAS) for data privacy implications.", "scf_control": "Supply Chain Risk Assessment (SCRA)", "scf_control_id": "RSK-21", "crosswalks": { "NIST 800-53 R5.2": [ "RA-03(01)", "SR-03", "SR-06" ], "NIST CSF 2.0": [ "GV.SC", "GV.SC-03", "GV.SC-09" ], "NIST Privacy Framework 1.0": [ "ID.DE-P5", "GV.MT-P1" ] } }, { "principle_name": "Risk Awareness", "description": "Maintain a current and accurate register of risk (e.g., Plan of Action & Milestones (POA&M), risk register, etc.).", "scf_control": "Capabilities Deficiency Tracking", "scf_control_id": "IAO-12", "crosswalks": { "NIST 800-53 R5.2": [ "CA-05", "PM-04", "SA-15(02)" ], "NIST CSF 2.0": [ "ID.RA-01", "ID.IM-01", "ID.IM-02" ], "NIST Privacy Framework 1.0": [ "GV.MT-P4" ] } }, { "principle_name": "Risk Awareness", "description": "Maintain a current and accurate register of risk (e.g., Plan of Action & Milestones (POA&M), risk register, etc.).", "scf_control": "Risk Register", "scf_control_id": "RSK-14", "crosswalks": { "NIST CSF 2.0": [ "GV.RM-06", "ID", "ID.RA-01" ] } }, { "principle_name": "Risk Awareness", "description": "Maintain a current and accurate register of risk (e.g., Plan of Action & Milestones (POA&M), risk register, etc.).", "scf_control": "Risk Monitoring", "scf_control_id": "RSK-22", "crosswalks": { "NIST 800-53 R5.2": [ "CA-07(04)" ] } }, { "principle_name": "Risk Response", "description": "Responses to identified risks are appropriately identified, categorized and prioritized.", "scf_control": "Risk Response", "scf_control_id": "RSK-16", "crosswalks": { "ISO 27701 2025": [ "6.1.3" ], "NIST 800-53 R5.2": [ "RA-07" ], "NIST CSF 2.0": [ "GV.RM-04", "ID.RA-05", "ID.RA-06" ], "USA Montana CDPA 2025": [ "30-14-2819(5)" ] } }, { "principle_name": "Data Protection Impact Assessment (DPIA)", "description": "Utilize Data Protection Impact Assessments (DPIAs) to effectively identify and reduce data privacy risks to an acceptable level.", "scf_control": "Data Protection Impact Assessment (DPIA)", "scf_control_id": "RSK-19", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.3-POF2" ], "ISO 27701 2025": [ "6.1.2", "6.1.2(a)", "6.1.2(a)(1)", "6.1.2(a)(2)", "6.1.2(b)", "6.1.2(c)", "6.1.2(c)(1)", "6.1.2(c)(2)", "6.1.2(d)", "6.1.2(d)(1)", "6.1.2(d)(2)", "6.1.2(d)(3)", "6.1.2(e)", "6.1.2(e)(1)", "6.1.2(e)(2)", "8.2" ], "NIST 800-53 R5.2": [ "RA-08" ], "NIST Privacy Framework 1.0": [ "ID.IM-P7", "ID.RA-P1", "ID.RA-P2", "ID.RA-P3", "ID.RA-P4", "ID.RA-P5", "ID.DE-P2", "ID.DE-P3", "GV.MT-P1" ], "USA California CCPA 2025": [ "7152(a)", "7152(a)(1)", "7152(a)(2)", "7152(a)(3)", "7152(a)(3)(A)", "7152(a)(3)(B)", "7152(a)(3)(C)", "7152(a)(3)(D)", "7152(a)(3)(E)", "7152(a)(3)(F)", "7152(a)(3)(G)", "7152(a)(3)(G)(i)", "7152(a)(3)(G)(ii)", "7152(a)(4)", "7152(a)(5)", "7152(a)(5)(A)", "7152(a)(5)(B)", "7152(a)(5)(C)", "7152(a)(5)(D)", "7152(a)(5)(E)", "7152(a)(5)(F)", "7152(a)(5)(G)", "7152(a)(5)(H)", "7152(a)(6)", "7152(a)(6)(A)", "7152(a)(6)(A)(i)", "7152(a)(6)(A)(ii)", "7152(a)(6)(A)(iii)", "7152(a)(6)(A)(iv)", "7152(a)(7)", "7152(a)(8)", "7152(a)(9)", "7154(a)", "7155(a)", "7156(a)", "7156(b)" ], "USA Montana CDPA 2025": [ "30-14-2813(1)(c)", "30-14-2814(1)", "30-14-2814(1)(a)", "30-14-2814(1)(b)", "30-14-2814(1)(c)", "30-14-2814(1)(d)", "30-14-2814(2)(a)", "30-14-2814(2)(b)", "30-14-2814(3)(a)", "30-14-2814(4)", "30-14-2814(5)", "30-14-2817(3)", "30-14-2818(1)(b)", "30-14-2819(1)", "30-14-2819(1)(a)", "30-14-2819(1)(b)", "30-14-2819(2)(a)", "30-14-2819(2)(b)", "30-14-2819(3)", "30-14-2819(4)", "30-14-2819(5)", "30-14-2819(6)" ], "USA Oregon CPA 2023": [ "Section 6(1)(c)", "Section 8(1)(a)", "Section 8(1)(c)", "Section 8(2)" ], "USA Oregon 646A 2025": [ "646A.586(1)(a)", "646A.586(1)(b)", "646A.586(1)(b)(A)", "646A.586(1)(b)(B)", "646A.586(1)(b)(C)", "646A.586(1)(b)(D)", "646A.586(1)(b)(D)(i)", "646A.586(1)(b)(D)(ii)", "646A.586(1)(b)(D)(iii)", "646A.586(1)(b)(D)(iv)", "646A.586(1)(c)", "646A.586(2)", "646A.586(4)", "646A.586(5)" ], "USA Tennessee TIPA 2025": [ "47-18-3206(a)", "47-18-3206(a)(1)", "47-18-3206(a)(2)", "47-18-3206(a)(3)", "47-18-3206(a)(3)(A)", "47-18-3206(a)(3)(B)", "47-18-3206(a)(3)(C)", "47-18-3206(a)(3)(D)", "47-18-3206(a)(4)", "47-18-3206(a)(5)", "47-18-3206(b)", "47-18-3206(c)", "47-18-3206(d)", "47-18-3206(e)", "47-18-3206(f)" ], "USA Texas CDPA 2025": [ "541.105(a)(1)", "541.105(a)(2)", "541.105(a)(3)(A)", "541.105(a)(3)(B)", "541.105(a)(3)(C)", "541.105(a)(3)(D)", "541.105(a)(4)", "541.105(a)(5)", "541.105(b)(1)", "541.105(b)(2)(A)", "541.105(b)(2)(B)", "541.105(b)(2)(C)", "541.105(b)(2)(D)", "541.105(c)", "541.105(d)", "541.105(e)", "541.105(f)" ], "USA Virginia CDPA 2023": [ "59.1-580.A", "59.1-580.A.1", "59.1-580.A.2", "59.1-580.A.3", "59.1-580.A.4", "59.1-580.A.5", "59.1-580.B", "59.1-580.C", "59.1-580.D", "59.1-580.E", "59.1-580.F", "59.1-580.G" ], "EMEA EU GDPR 2016": [ "Article 35.1", "Article 35.3(a)", "Article 35.3(b)", "Article 35.3(c)", "Article 35.7(a)", "Article 35.7(b)", "Article 35.7(c)", "Article 35.7(d)", "Article 35.8", "Article 35.9", "Article 35.11", "Article 36.1" ], "EMEA UK DPA 2018": [ "Section 64(1)", "Section 64(2)", "Section 64(3)", "Section 64(3)(a)", "Section 64(3)(b)", "Section 64(3)(c)", "Section 64(3)(d)", "Section 64(4)" ], "Americas Canada PIPEDA 2000": [ "P5-4.5.1" ] } }, { "principle_name": "Third-Party Management", "description": "Provide data privacy oversight of third-parties with access to personal data, so that only trusted third-parties are contracted with.", "scf_control": "Third-Party Management", "scf_control_id": "TPM-02", "crosswalks": { "ISO 27701 2025": [ "6.1.3(h)" ], "NIST 800-53 R5.2": [ "SA-04", "SR-01" ], "NIST CSF 2.0": [ "GV.SC-04", "GV.SC-06", "GV.SC-07", "GV.SC-08", "GV.SC-10", "ID.AM" ], "NIST Privacy Framework 1.0": [ "GV.PO-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)", "§ 164.312(d)" ], "USA California CCPA 2025": [ "7024(l)", "7052(a)", "7123(c)(15)" ], "USA Vermont Act 171 2018": [ "2447(b)(6)" ] } }, { "principle_name": "Third-Party Management", "description": "Provide data privacy oversight of third-parties with access to personal data, so that only trusted third-parties are contracted with.", "scf_control": "Third-Party Services", "scf_control_id": "TPM-12", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09" ], "NIST CSF 2.0": [ "GV.SC-06", "GV.SC-07" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Third-Party Management", "description": "Provide data privacy oversight of third-parties with access to personal data, so that only trusted third-parties are contracted with.", "scf_control": "Review of Third-Party Services", "scf_control_id": "TPM-15", "crosswalks": { "NIST 800-53 R5.2": [ "SR-06", "SR-06(01)" ], "NIST CSF 2.0": [ "GV.SC-07", "ID.IM-01", "ID.IM-02" ], "NIST Privacy Framework 1.0": [ "ID.DE-P5" ], "USA California CCPA 2025": [ "7051(c)", "7053(b)", "7123(c)(15)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(5)(d)(II)(B)" ], "USA Montana CDPA 2025": [ "30-14-2813(2)(c)", "30-14-2813(2)(e)", "30-14-2815(5)" ] } }, { "principle_name": "Third-Party Management", "description": "Provide data privacy oversight of third-parties with access to personal data, so that only trusted third-parties are contracted with.", "scf_control": "Managing Changes To Third-Party Services", "scf_control_id": "TPM-17", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04" ], "NIST CSF 2.0": [ "GV.SC-08" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Third-Party Management", "description": "Provide data privacy oversight of third-parties with access to personal data, so that only trusted third-parties are contracted with.", "scf_control": "Third-Party Deficiency Remediation", "scf_control_id": "TPM-18", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.5-POF1", "D6.6-POF1" ], "NIST CSF 2.0": [ "GV.SC-06", "GV.SC-07", "GV.SC-08" ], "USA California CCPA 2025": [ "7053(a)(5)", "7123(c)(15)" ], "USA Montana CDPA 2025": [ "30-14-2815(5)" ] } }, { "principle_name": "Supply Chain Protections", "description": "Govern the disclosure of personal data to ensure it is only provided to trusted third-parties that can store, process and/or transmit it in a secure manner.", "scf_control": "Supply Chain Risk Management (SCRM)", "scf_control_id": "TPM-04", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09(03)", "SR-02", "SR-02(01)" ], "NIST CSF 2.0": [ "GV.SC", "GV.SC-06", "GV.SC-07" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Supply Chain Protections", "description": "Govern the disclosure of personal data to ensure it is only provided to trusted third-parties that can store, process and/or transmit it in a secure manner.", "scf_control": "Third-Party Services", "scf_control_id": "TPM-12", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09" ], "NIST CSF 2.0": [ "GV.SC-06", "GV.SC-07" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Secure Disclosure To Third-Parties", "description": "Govern third-party use of personal data to ensure data privacy requirements are enforced when a third-party stores, processes or transmits personal data on behalf of the organization.", "scf_control": "Information Sharing With Third Parties", "scf_control_id": "PRI-16", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.1-POF3", "D6.1-POF4", "D6.4-POF1", "S7.3" ], "ISO 29100 2024": [ "6.10" ], "NIST 800-53 R5.2": [ "AC-21" ], "NIST Privacy Framework 1.0": [ "CT.PO-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.506(c)(1)", "§ 164.506(c)(2)", "§ 164.506(c)(3)", "§ 164.506(c)(4)", "§ 164.508(a)(1)", "§ 164.508(a)(4)(i)" ], "USA Montana CDPA 2025": [ "30-14-2812(5)(c)", "30-14-2812(5)(d)" ], "USA Oregon CPA 2023": [ "Section 6(1)(a)", "Section 6(1)(c)" ], "APAC New Zealand Privacy Act of 2020": [ "3.1.22.11(1)", "3.1.22.11(1)(a)", "3.1.22.11(1)(b)", "3.1.22.11(1)(c)", "3.1.22.11(1)(d)", "3.1.22.11(1)(e)", "3.1.22.11(1)(e)(i)", "3.1.22.11(1)(e)(ii)", "3.1.22.11(1)(e)(iii)", "3.1.22.11(1)(e)(iv)", "3.1.22.11(1)(f)", "3.1.22.11(1)(f)(i)", "3.1.22.11(1)(f)(ii)", "3.1.22.11(1)(g)", "3.1.22.11(1)(h)", "3.1.22.11(1)(h)(i)", "3.1.22.11(1)(h)(ii)", "3.1.22.11(1)(i)" ] } }, { "principle_name": "Contractual Obligations for Third-Parties", "description": "Require terms and conditions in contracts and other agreements to cover the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data.", "scf_control": "Data Privacy Requirements for Contractors & Service Providers", "scf_control_id": "PRI-14", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.4" ], "ISO 29100 2024": [ "6.10" ], "NIST CSF 2.0": [ "GV.SC-05" ], "NIST Privacy Framework 1.0": [ "ID.DE-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.504(e)(2)(i)", "§ 164.504(e)(2)(ii)(A)", "§ 164.504(e)(2)(ii)(B)", "§ 164.504(e)(2)(ii)(C)", "§ 164.504(e)(4)(i)", "§ 164.504(e)(4)(i)(A)", "§ 164.504(e)(4)(i)(B)", "§ 164.504(e)(4)(i)(B)(ii)", "§ 164.504(e)(4)(i)(B)(ii)(A)" ], "USA California CCPA 2025": [ "7012(g)(2)", "7022(c)", "7022(c)(1)", "7022(c)(2)", "7022(c)(3)", "7022(c)(4)", "7022(d)", "7023(c)", "7024(i)", "7050(a)", "7050(a)(1)", "7050(a)(2)", "7050(a)(3)", "7050(a)(4)", "7050(b)", "7050(c)", "7050(d)", "7050(e)", "7050(f)", "7050(g)", "7050(h)", "7050(h)(1)", "7050(h)(2)", "7051(a)", "7051(a)(1)", "7051(a)(2)", "7051(a)(3)", "7051(a)(4)", "7051(a)(5)", "7051(a)(6)", "7051(a)(7)", "7051(a)(8)", "7051(a)(9)", "7053(a)(1)", "7053(a)(2)", "7053(a)(3)", "7053(a)(4)" ], "USA Illinois PIPA 2006": [ "45(b)" ], "USA Montana CDPA 2025": [ "30-14-2813(1)", "30-14-2813(1)(a)", "30-14-2813(1)(b)", "30-14-2813(1)(c)", "30-14-2813(2)", "30-14-2813(2)(d)", "30-14-2815(1)(c)", "30-14-2815(5)", "30-14-2818(1)", "30-14-2818(1)(a)", "30-14-2818(1)(b)", "30-14-2818(2)" ], "USA Nevada Privacy Law 2023": [ "603A.210.3", "603A.495.3(d)", "603A.530.1", "603A.530.2", "603A.530.3", "603A.530.3(a)", "603A.530.3(b)" ], "USA Oregon CPA 2023": [ "Section 6(1)", "Section 6(1)(a)", "Section 6(2)", "Section 7(1)(a)(C)" ], "USA Oregon 646A 2025": [ "646A.581(2)" ], "USA Tennessee TIPA 2025": [ "47-18-3205(a)", "47-18-3205(a)(1)", "47-18-3205(a)(2)", "47-18-3205(b)", "47-18-3205(b)(1)", "47-18-3205(b)(2)", "47-18-3205(b)(3)", "47-18-3205(b)(4)", "47-18-3205(b)(5)", "47-18-3205(c)", "47-18-3205(d)" ], "USA Texas CDPA 2025": [ "541.104(a)(1)", "541.104(a)(2)", "541.104(a)(3)", "541.104(b)(1)", "541.104(b)(2)", "541.104(b)(3)", "541.104(b)(4)", "541.104(b)(5)", "541.104(b)(6)(A)", "541.104(b)(6)(B)", "541.104(b)(6)(C)", "541.104(b)(6)(D)", "541.104(b)(6)(E)", "541.104(c)", "541.106(a)(3)", "541.106(d)" ], "USA Virginia CDPA 2023": [ "59.1-578.B", "59.1-579.A", "59.1-579.A.1", "59.1-579.A.2", "59.1-579.A.3", "59.1-579.B", "59.1-579.B.3", "59.1-579.B.4", "59.1-579.B.5", "59.1-581.A.3", "59.1-581.E" ], "EMEA EU GDPR 2016": [ "Article 28.1", "Article 28.2", "Article 28.3", "Article 28.3(a)", "Article 28.3(b)", "Article 28.3(c)", "Article 28.3(d)", "Article 28.3(e)", "Article 28.3(f)", "Article 28.3(g)", "Article 28.3(h)", "Article 28.4", "Article 28.5", "Article 28.6", "Article 28.7", "Article 28.8", "Article 28.9", "Article 28.10", "Article 29", "Article 46.3(a)" ], "EMEA UK DPA 2018": [ "Section 59(1)", "Section 59(2)", "Section 59(2)(a)", "Section 59(2)(b)", "Section 59(3)", "Section 59(4)", "Section 59(5)", "Section 59(5)(a)", "Section 59(5)(b)", "Section 59(5)(c)", "Section 59(5)(d)", "Section 59(6)", "Section 59(6)(a)", "Section 59(6)(b)", "Section 59(6)(c)", "Section 59(6)(d)", "Section 59(6)(d)(i)", "Section 59(6)(d)(ii)", "Section 59(6)(e)", "Section 59(6)(f)", "Section 59(7)", "Section 59(7A)", "Section 59(8)", "Section 60", "Section 60(a)", "Section 60(b)", "Section 63" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.3" ] } }, { "principle_name": "Contractual Obligations for Third-Parties", "description": "Require terms and conditions in contracts and other agreements to cover the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data.", "scf_control": "Third-Party Contract Requirements", "scf_control_id": "TPM-14", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.5", "D6.5-POF2" ], "ISO 27701 2025": [ "6.1.3(h)" ], "NIST 800-53 R5.2": [ "SR-03(03)" ], "NIST CSF 2.0": [ "GV.OC-02", "GV.OC-03", "GV.SC-02", "GV.SC-05", "GV.SC-06" ], "NIST Privacy Framework 1.0": [ "ID.DE-P3", "GV.PO-P4", "GV.AT-P4" ], "USA Federal Data Privacy Framework 2023": [ "II.3.a", "II.3.b", "II.7.d", "III.10.a.i", "III.10.a.ii.1", "III.10.a.ii.2", "III.10.a.ii.3", "III.10.a.iii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)", "§ 164.308(b)(2)", "§ 164.308(b)(3)", "§ 164.314(a)(2)(iii)", "§ 164.314(b)(1)", "§ 164.314(b)(2)(i)", "§ 164.314(b)(2)(ii)", "§ 164.314(b)(2)(iii)", "§ 164.502(a)(4)(i)", "§ 164.502(a)(4)(ii)", "§ 164.502(e)(1)(i)", "§ 164.502(e)(2)", "§ 164.504(e)(2)(i)", "§ 164.504(e)(2)(i)(A)", "§ 164.504(e)(2)(i)(B)", "§ 164.504(e)(2)(ii)(J)", "§ 164.504(e)(4)(i)(B)(ii)(B)(1)", "§ 164.504(e)(4)(i)(B)(ii)(B)(2)", "§ 164.504(f)(1)(i)", "§ 164.504(f)(2)(i)", "§ 164.504(f)(2)(ii)", "§ 164.504(f)(2)(ii)(A)", "§ 164.504(f)(2)(ii)(B)", "§ 164.504(f)(2)(ii)(C)", "§ 164.504(f)(2)(ii)(D)", "§ 164.504(f)(2)(ii)(E)", "§ 164.504(f)(2)(ii)(F)", "§ 164.504(f)(2)(ii)(G)", "§ 164.504(f)(2)(ii)(H)", "§ 164.504(f)(2)(ii)(I)", "§ 164.504(f)(2)(ii)(J)", "§ 164.504(f)(2)(iii)(A)", "§ 164.504(f)(2)(iii)(B)", "§ 164.504(f)(2)(iii)(C)", "§ 164.504(f)(3)(i)", "§ 164.504(f)(3)(ii)", "§ 164.504(f)(3)(iii)", "§ 164.504(f)(3)(iv)" ], "USA California CCPA 2025": [ "7012(g)(2)", "7051(a)", "7052(b)", "7053(a)", "7053(a)(6)", "7123(c)(3)(A)(ii)", "7123(c)(3)(A)(iii)", "7123(c)(15)", "7153(a)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(5)", "6-1-1305(5)(a)", "6-1-1305(5)(b)", "6-1-1305(5)(c)", "6-1-1305(5)(d)", "6-1-1305(5)(d)(I)", "6-1-1305(5)(d)(II)(A)", "6-1-1305(5)(d)(II)(B)" ], "USA Montana CDPA 2025": [ "30-14-2813(2)", "30-14-2815(1)(c)", "30-14-2818(2)" ], "USA Oregon CPA 2023": [ "Section 6(2)(a)", "Section 6(2)(b)", "Section 6(2)(c)", "Section 6(2)(d)", "Section 6(2)(e)", "Section 6(2)(f)", "Section 6(2)(g)", "Section 6(2)(h)" ], "USA Oregon 646A 2025": [ "646A.581(2)", "646A.581(2)(a)", "646A.581(2)(b)", "646A.581(2)(c)", "646A.581(2)(d)", "646A.581(2)(e)", "646A.581(2)(f)", "646A.581(2)(g)", "646A.581(2)(h)" ], "USA Texas CDPA 2025": [ "541.104(a)", "541.104(b)" ], "USA Virginia CDPA 2023": [ "59.1-579.B.5" ], "USA Vermont Act 171 2018": [ "2447(b)(6)(B)" ] } }, { "principle_name": "Contractual Obligations for Third-Parties", "description": "Require terms and conditions in contracts and other agreements to cover the collection, receiving, processing, storage, transmission, sharing, updating and/or disposal of personal data.", "scf_control": "Contract Flow-Down Requirements", "scf_control_id": "TPM-14.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.5-POF2" ], "ISO 27701 2025": [ "6.1.3(h)" ], "NIST 800-53 R5.2": [ "SR-03(03)" ], "NIST CSF 2.0": [ "GV.OC-03", "GV.SC-02", "GV.SC-05", "GV.SC-06", "GV.SC-10" ], "USA Federal Data Privacy Framework 2023": [ "II.7.d", "III.10.a.ii.1", "III.10.a.ii.2", "III.10.a.ii.3", "III.10.a.iii" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)", "§ 164.308(b)(2)", "§ 164.314(a)(2)(i)(B)", "§ 164.314(a)(2)(iii)", "§ 164.502(e)(1)(ii)", "§ 164.504(e)(2)(ii)(D)" ], "USA California CCPA 2025": [ "7051(b)", "7052(b)", "7053(a)", "7123(c)(15)" ], "USA Montana CDPA 2025": [ "30-14-2813(2)(d)" ], "USA Virginia CDPA 2023": [ "59.1-579.B.5" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Personal Data (PD) Control Testing, Training & Monitoring", "scf_control_id": "PRI-11", "crosswalks": { "NIST 800-53 R5.2": [ "PM-14" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix", "scf_control_id": "TPM-11", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09(03)" ], "NIST CSF 2.0": [ "GV.OC", "GV.OC-02", "GV.RM-05", "GV.RR", "GV.RR-02", "GV.SC-02", "GV.SC-06", "ID.AM" ], "NIST Privacy Framework 1.0": [ "ID.IM-P2", "GV.PO-P3", "GV.PO-P4", "GV.AT-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)" ], "USA California CCPA 2025": [ "7052(a)", "7123(c)(3)(A)(ii)", "7123(c)(15)" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Third-Party Services", "scf_control_id": "TPM-12", "crosswalks": { "NIST 800-53 R5.2": [ "SA-09" ], "NIST CSF 2.0": [ "GV.SC-06", "GV.SC-07" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Review of Third-Party Services", "scf_control_id": "TPM-15", "crosswalks": { "NIST 800-53 R5.2": [ "SR-06", "SR-06(01)" ], "NIST CSF 2.0": [ "GV.SC-07", "ID.IM-01", "ID.IM-02" ], "NIST Privacy Framework 1.0": [ "ID.DE-P5" ], "USA California CCPA 2025": [ "7051(c)", "7053(b)", "7123(c)(15)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(5)(d)(II)(B)" ], "USA Montana CDPA 2025": [ "30-14-2813(2)(c)", "30-14-2813(2)(e)", "30-14-2815(5)" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Third-Party Scope Review", "scf_control_id": "TPM-16", "crosswalks": { "NIST CSF 2.0": [ "GV.SC-06" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Managing Changes To Third-Party Services", "scf_control_id": "TPM-17", "crosswalks": { "NIST 800-53 R5.2": [ "SA-04" ], "NIST CSF 2.0": [ "GV.SC-08" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Third-Party Compliance", "description": "Validate that data privacy controls for Technology Assets, Applications and/or Services (TAAS) used or operated by third-parties are effectively-implemented and align with industry-recognized secure practices, as well as comply with applicable statutory, regulatory and contractual obligations.", "scf_control": "Third-Party Deficiency Remediation", "scf_control_id": "TPM-18", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.5-POF1", "D6.6-POF1" ], "NIST CSF 2.0": [ "GV.SC-06", "GV.SC-07", "GV.SC-08" ], "USA California CCPA 2025": [ "7053(a)(5)", "7123(c)(15)" ], "USA Montana CDPA 2025": [ "30-14-2815(5)" ] } }, { "principle_name": "Business Environment", "description": "The organization's mission, objectives, stakeholders and activities are understood and prioritized to provide resourcing and guidance for data privacy roles, responsibilities and risk management decisions.", "scf_control": "Security, Compliance & Resilience Resource Management", "scf_control_id": "PRM-05", "crosswalks": { "ISO 27701 2025": [ "7.1" ], "NIST 800-53 R5.2": [ "PM-03" ], "NIST CSF 2.0": [ "GV.RR-03" ] } }, { "principle_name": "Business Environment", "description": "The organization's mission, objectives, stakeholders and activities are understood and prioritized to provide resourcing and guidance for data privacy roles, responsibilities and risk management decisions.", "scf_control": "Third-Party Management", "scf_control_id": "TPM-02", "crosswalks": { "ISO 27701 2025": [ "6.1.3(h)" ], "NIST 800-53 R5.2": [ "SA-04", "SR-01" ], "NIST CSF 2.0": [ "GV.SC-04", "GV.SC-06", "GV.SC-07", "GV.SC-08", "GV.SC-10", "ID.AM" ], "NIST Privacy Framework 1.0": [ "GV.PO-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(b)(1)", "§ 164.312(d)" ], "USA California CCPA 2025": [ "7024(l)", "7052(a)", "7123(c)(15)" ], "USA Vermont Act 171 2018": [ "2447(b)(6)" ] } }, { "principle_name": "Data Privacy Protections Context", "description": "Identify and document the organization's role as a controller and/or processor of sensitive/regulated data, including instances involving more than one party.", "scf_control": "Defining Business Context & Mission", "scf_control_id": "GOV-06", "crosswalks": { "ISO 27701 2025": [ "4.1", "6.1.1" ], "NIST CSF 2.0": [ "GV.OC", "GV.OC-01", "GV.OC-04", "GV.OV-01", "GV.SC-03" ], "NIST Privacy Framework 1.0": [ "ID.IM-P5", "ID.BE-P1", "ID.BE-P2", "GV.RM-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(b)(2)(i)" ] } }, { "principle_name": "Data Privacy Protections Context", "description": "Identify and document the organization's role as a controller and/or processor of sensitive/regulated data, including instances involving more than one party.", "scf_control": "Joint Processing of Personal Data (PD)", "scf_control_id": "PRI-43", "crosswalks": { "NIST Privacy Framework 1.0": [ "ID.BE-P1" ], "USA Montana CDPA 2025": [ "30-14-2813(4)", "30-14-2818(4)" ], "USA Oregon CPA 2023": [ "Section 6(1)(a)" ], "USA Tennessee TIPA 2025": [ "47-18-3205(d)" ], "EMEA UK DPA 2018": [ "Section 58(1)", "Section 58(2)", "Section 58(3)" ] } }, { "principle_name": "Policies, Standards & Procedures", "description": "Ensure appropriate policies, standards and procedures exist to operationalize the data privacy program.", "scf_control": "Publishing Security, Compliance & Resilience Documentation", "scf_control_id": "GOV-04", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0", "M1.2", "M1.2-POF8", "D6.1-POF1" ], "ISO 27701 2025": [ "5.1", "5.2", "5.2(a)", "5.2(b)", "5.2(c)", "5.2(d)", "6.1.3(c)", "7.5.1(b)", "7.5.2", "7.5.3" ], "NIST 800-53 R5.2": [ "AC-01", "AT-01", "AU-01", "CA-01", "CM-01", "CP-01", "IA-01", "IR-01", "MA-01", "MP-01", "PE-01", "PL-01", "PM-01", "PS-01", "PT-01", "RA-01", "SA-01", "SC-01", "SI-01", "SR-01" ], "NIST CSF 2.0": [ "GV.PO", "GV.PO-01", "GV.SC-01", "GV.SC-03", "ID.RA" ], "NIST Privacy Framework 1.0": [ "ID.DE-P1", "GV.PO-P", "GV.PO-P1", "GV.PO-P6", "GV.MT-P", "GV.MT-P4", "GV.MT-P5", "GV.MT-P6", "GV.MT-P7", "CT.PO-P", "CT.PO-P1", "CT.PO-P2", "CT.PO-P3", "CM.PO-P1", "PR.PO-P", "PR.PO-P4" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(1)(i)", "§ 164.308(a)(3)(i)", "§ 164.308(a)(4)(i)", "§ 164.308(a)(4)(ii)(A)", "§ 164.308(a)(6)(i)", "§ 164.308(a)(7)(i)", "§ 164.310(a)(1)", "§ 164.310(a)(2)(ii)", "§ 164.310(a)(2)(iv)", "§ 164.310(b)", "§ 164.310(d)(1)", "§ 164.310(d)(2)(i)", "§ 164.312(a)(1)", "§ 164.312(c)(1)", "§ 164.316(a)", "§ 164.316(b)(1)(i)", "§ 164.530(j)(1)(i)" ], "USA California CCPA 2025": [ "7123(b)(1)" ], "USA Illinois IPA 2009": [ "35(a)", "37(a)" ], "USA Nevada Privacy Law 2023": [ "603A.525.2", "603A.525.2(a)" ], "EMEA EU GDPR 2016": [ "Article 24.2" ], "APAC Australian Privacy Principles 2026": [ "1.1.3" ], "Americas Canada PIPEDA 2000": [ "P1-4.1.4" ] } }, { "principle_name": "Policies, Standards & Procedures", "description": "Ensure appropriate policies, standards and procedures exist to operationalize the data privacy program.", "scf_control": "Dissemination of Data Privacy Program Information", "scf_control_id": "PRI-20", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF1" ], "ISO 27701 2025": [ "6.2(e)", "7.4", "7.5.3(a)" ], "ISO 29100 2024": [ "6.8" ], "NIST 800-53 R5.2": [ "PM-20" ], "NIST Privacy Framework 1.0": [ "GV.PO-P1", "CM.PO-P1", "CM.AW-P1" ], "OECD Privacy Principles": [ "6" ], "USA Federal FIPPS 1973": [ "8" ], "USA Montana CDPA 2025": [ "30-14-2815(1)(b)" ], "USA Oregon CPA 2023": [ "Section 7(1)(a)(B)" ], "USA Virginia CDPA 2023": [ "59.1-581.A.2" ] } }, { "principle_name": "Periodic Review", "description": "At planned intervals or after significant changes, review policies, standards and procedures to ensure the continuing suitability, adequacy and effectiveness to meet the organization's applicable statutory, regulatory and contractual needs.", "scf_control": "Conformity Monitoring", "scf_control_id": "CPL-05", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "S7.5", "S7.5-POF1" ], "NIST 800-53 R5.2": [ "CA-02" ], "NIST CSF 2.0": [ "ID.IM-01", "ID.IM-02" ], "NIST Privacy Framework 1.0": [ "ID.DE-P5", "CT.DM-P9" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(d)(3)(i)", "§ 164.316(b)(1)(ii)" ], "USA California CCPA 2025": [ "7120(a)", "7122(b)" ] } }, { "principle_name": "Periodic Review", "description": "At planned intervals or after significant changes, review policies, standards and procedures to ensure the continuing suitability, adequacy and effectiveness to meet the organization's applicable statutory, regulatory and contractual needs.", "scf_control": "Periodic Review & Update of Security, Compliance & Resilience Program", "scf_control_id": "GOV-04.1", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF5", "M1.3-POF4" ], "NIST 800-53 R5.2": [ "AC-01", "AT-01", "AU-01", "CA-01", "CM-01", "CP-01", "IA-01", "IR-01", "MA-01", "MP-01", "PE-01", "PL-01", "PM-01", "PS-01", "PT-01", "RA-01", "SA-01", "SC-01", "SI-01", "SR-01" ], "NIST CSF 2.0": [ "GV.PO-02", "GV.OV", "GV.OV-01", "GV.OV-02" ], "NIST Privacy Framework 1.0": [ "GV.MT-P2" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.316(b)(1)(ii)", "§ 164.316(b)(2)(iii)", "§ 164.530(i)(2)(i)", "§ 164.530(i)(2)(ii)", "§ 164.530(i)(2)(iii)", "§ 164.530(i)(3)" ], "USA Vermont Act 171 2018": [ "2447(b)(8)(B)", "2447(b)(9)", "2447(b)(9)(A)", "2447(b)(9)(B)" ] } }, { "principle_name": "Oversight", "description": "Provide oversight of data privacy controls throughout the lifecycle of Technology Assets, Applications and/or Services (TAAS) to ensure that in a timely manner, senior leaders with the organization are made aware of data privacy-related risks that are not appropriately remediated.", "scf_control": "Executive Leadership Oversight of Security, Compliance & Resilience Controls", "scf_control_id": "CPL-07", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.0-POF8", "S7.5-POF1", "M9.1-POF6" ], "ISO 27701 2025": [ "9.2.2", "9.2.2(a)", "9.2.2(b)", "9.2.2(c)" ], "ISO 29100 2024": [ "6.12" ], "NIST 800-53 R5.2": [ "CA-07", "CA-07(01)", "PM-14" ], "NIST CSF 2.0": [ "GV.OC-03" ], "NIST Privacy Framework 1.0": [ "GV.MT-P4", "PR.PO-P5" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(d)(3)(i)", "§ 164.316(b)(2)(iii)" ], "USA California CCPA 2025": [ "7122(a)(3)", "7122(f)" ], "USA Vermont Act 171 2018": [ "2447(b)(2)(C)", "2447(b)(8)(A)" ], "EMEA EU GDPR 2016": [ "Article 32.1(d)" ] } }, { "principle_name": "Oversight", "description": "Provide oversight of data privacy controls throughout the lifecycle of Technology Assets, Applications and/or Services (TAAS) to ensure that in a timely manner, senior leaders with the organization are made aware of data privacy-related risks that are not appropriately remediated.", "scf_control": "Data Management Board", "scf_control_id": "DCH-33.1", "crosswalks": { "NIST 800-53 R5.2": [ "PM-23", "PM-24" ] } }, { "principle_name": "Metrics & Trends", "description": "Provide performance metrics and trend analysis to enable management visibility and coordinate data privacy efforts across the organization.", "scf_control": "Status Reporting To Governing Body", "scf_control_id": "GOV-09.1", "crosswalks": { "ISO 27701 2025": [ "5.1", "5.3(b)", "9.3.1" ], "NIST CSF 2.0": [ "GV.OV", "GV.OV-01", "GV.OV-03", "GV.SC", "GV.SC-09", "ID" ], "NIST Privacy Framework 1.0": [ "PR.PO-P6" ] } }, { "principle_name": "Metrics & Trends", "description": "Provide performance metrics and trend analysis to enable management visibility and coordinate data privacy efforts across the organization.", "scf_control": "Measures of Performance", "scf_control_id": "GOV-12", "crosswalks": { "ISO 27701 2025": [ "9.1" ], "NIST 800-53 R5.2": [ "PM-06" ], "NIST CSF 2.0": [ "GV", "GV.OV", "GV.OV-01", "GV.OV-03", "GV.SC", "GV.SC-09", "ID.IM-03" ], "NIST Privacy Framework 1.0": [ "GV.MT-P4", "PR.PO-P5", "PR.PO-P6" ] } }, { "principle_name": "Metrics & Trends", "description": "Provide performance metrics and trend analysis to enable management visibility and coordinate data privacy efforts across the organization.", "scf_control": "Documenting Data Processing Activities", "scf_control_id": "PRI-05", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "D6.2", "D6.2-POF1" ], "NIST 800-53 R5.2": [ "PM-27" ], "NIST Privacy Framework 1.0": [ "CM.AW-P4", "CM.AW-P6" ], "USA Nevada Privacy Law 2023": [ "603A.535.3", "603A.535.3(a)", "603A.535.3(b)", "603A.535.3(c)", "603A.535.3(d)", "603A.535.3(e)", "603A.535.3(f)", "603A.535.3(g)", "603A.535.3(h)", "603A.535.3(i)", "603A.535.8" ], "USA Texas CDPA 2025": [ "541.052(f)(1)" ], "EMEA EU GDPR 2016": [ "Article 30.1", "Article 30.1(a)", "Article 30.1(b)", "Article 30.1(c)", "Article 30.1(d)", "Article 30.1(e)", "Article 30.1(f)", "Article 30.1(g)", "Article 30.2", "Article 30.2(a)", "Article 30.2(b)", "Article 30.2(c)", "Article 30.2(d)", "Article 30.3" ], "EMEA UK DPA 2018": [ "Section 61(1)", "Section 61(2)", "Section 61(2)(a)", "Section 61(2)(b)", "Section 61(2)(c)", "Section 61(2)(d)", "Section 61(2)(e)", "Section 61(2)(f)", "Section 61(2)(f)(i)", "Section 61(2)(f)(ii)", "Section 61(2)(g)", "Section 61(2)(h)", "Section 61(2)(h)(i)", "Section 61(2)(j)", "Section 61(2)(k)", "Section 61(3)", "Section 61(4)", "Section 61(4)(a)", "Section 61(4)(b)", "Section 61(4)(c)", "Section 61(4)(d)", "Section 61(4)(e)", "Section 61(4)(f)", "Section 61(5)", "Section 62(1)", "Section 62(1)(a)", "Section 62(1)(b)", "Section 62(1)(c)", "Section 62(1)(d)", "Section 62(1)(e)", "Section 62(1)(f)", "Section 62(2)", "Section 62(2)(a)", "Section 62(2)(b)", "Section 62(3)", "Section 62(3)(a)", "Section 62(3)(b)", "Section 62(3)(b)(i)", "Section 62(3)(b)(ii)", "Section 62(4)", "Section 62(4)(a)", "Section 62(4)(b)", "Section 62(4)(c)", "Section 62(4)(d)", "Section 62(5)" ], "APAC Australian Privacy Principles 2026": [ "3.6.5" ], "Americas Canada PIPEDA 2000": [ "P5-4.5.1" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Statutory, Regulatory & Contractual Compliance", "scf_control_id": "CPL-02", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF9" ], "ISO 27701 2025": [ "4.1", "4.2(a)", "4.2(b)", "4.2(c)" ], "ISO 29100 2024": [ "6.12" ], "NIST 800-53 R5.2": [ "PL-01", "PM-08" ], "NIST CSF 2.0": [ "GV.OC", "GV.OC-03", "GV.SC-05", "PR" ], "NIST Privacy Framework 1.0": [ "GV.PO-P5" ], "USA Federal Data Privacy Framework 2023": [ "II.7.c", "III.5.a", "III.5.b.i" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.306(c)", "§ 164.306(d)(1)", "§ 164.306(d)(2)", "§ 164.314(a)(1)", "§ 164.314(a)(2)(ii)", "§ 164.504(g)(1)", "§ 164.530(i)(1)" ], "USA California CCPA 2025": [ "7013(h)", "7022(d)", "7023(e)", "7050(b)", "7072(b)", "7123(b)(3)", "7200(a)", "7200(b)" ], "USA Colorado Colorado Privacy Act 2021": [ "6-1-1305(1)", "6-1-1305(2)", "6-1-1305(2)(b)", "6-1-1305(2)(c)", "6-1-1308(6)" ], "USA Illinois IPA 2009": [ "15", "25", "35(a)(1)", "37(a)(1)" ], "USA Montana CDPA 2025": [ "30-14-2812(2)(c)" ], "USA Nevada Privacy Law 2023": [ "603A.500.2(c)", "603A.525.2(b)" ], "USA Oregon CPA 2023": [ "Section 7(1)(b)" ], "USA Texas CDPA 2025": [ "541.101(b)(2)" ], "USA Virginia CDPA 2023": [ "59.1-581.E" ], "USA Vermont Act 171 2018": [ "2446(a)(2)", "2446(a)(3)", "2446(a)(3)(A)", "2446(a)(3)(B)", "2446(a)(3)(B)(i)", "2446(a)(3)(B)(ii)", "2446(a)(3)(B)(iii)", "2446(a)(3)(C)", "2446(a)(3)(D)", "2446(a)(3)(E)", "2446(a)(3)(F)", "2446(a)(3)(G)" ], "APAC Australian Privacy Principles 2026": [ "1.1.2.a" ], "APAC New Zealand Privacy Act of 2020": [ "6.2.126(1)", "6.2.126(2)", "6.2.126(2)(a)", "6.2.126(2)(b)" ], "Americas Canada PIPEDA 2000": [ "P1-4.1", "P1-4.1.3" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Compliance Scope", "scf_control_id": "CPL-03", "crosswalks": { "ISO 27701 2025": [ "4.3" ], "ISO 29100 2024": [ "6.12" ], "NIST CSF 2.0": [ "GV.SC-05" ], "USA California CCPA 2025": [ "7123(b)(2)", "7123(b)(3)" ], "EMEA EU GDPR 2016": [ "Article 3.1", "Article 3.2", "Article 3.2(a)", "Article 3.2(b)", "Article 3.3" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Ability To Demonstrate Conformity", "scf_control_id": "CPL-04", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA Federal Data Privacy Framework 2023": [ "II.7.b", "III.5.a" ], "USA California CCPA 2025": [ "7122(c)", "7123(b)(3)" ], "USA Montana CDPA 2025": [ "30-14-2811(1)(b)", "30-14-2813(2)(c)", "30-14-2815(4)", "30-14-2816(7)", "30-14-2817(3)" ], "USA Oregon CPA 2023": [ "Section 8(3)" ], "EMEA EU GDPR 2016": [ "Article 5.2", "Article 12.1", "Article 30.4", "Article 31" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Conformity Assessment", "scf_control_id": "CPL-04.1", "crosswalks": { "ISO 29100 2024": [ "6.12" ], "USA California CCPA 2025": [ "7122(a)", "7122(b)", "7122(d)", "7122(e)", "7122(f)", "7123(a)", "7123(b)", "7123(b)(2)", "7123(c)" ], "USA Montana CDPA 2025": [ "30-14-2813(2)(e)" ], "USA Virginia CDPA 2023": [ "59.1-579.B.4" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Non-Conformity Oversight", "scf_control_id": "CPL-06", "crosswalks": { "AICPA Privacy Management Framework (PMF)": [ "M1.2-POF6", "M1.2-POF7", "M9.1-POF4", "M9.1-POF5" ], "ISO 27701 2025": [ "10.2", "10.2(a)", "10.2(b)", "10.2(c)", "10.2(d)", "10.2(e)" ], "ISO 29100 2024": [ "6.12" ], "USA California CCPA 2025": [ "7123(b)(3)" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Event Log & Security-Relevant Telemetry Retention", "scf_control_id": "MON-13", "crosswalks": { "NIST 800-53 R5.2": [ "AU-11" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Privacy Act Exemptions", "scf_control_id": "PRI-20.2", "crosswalks": { "NIST 800-53 R5.2": [ "PT-06(02)" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "System of Records Notice (SORN)", "scf_control_id": "PRI-20.3", "crosswalks": { "NIST 800-53 R5.2": [ "PT-06" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "System of Records Notice (SORN) Review Process", "scf_control_id": "PRI-20.4", "crosswalks": { "NIST 800-53 R5.2": [ "PT-06(01)" ] } }, { "principle_name": "Compliance", "description": "Oversee the execution of data privacy controls to create appropriate evidence of due diligence and due care, demonstrating compliance with all applicable statutory, regulatory and contractual obligations, including age-based restrictions.", "scf_control": "Computer Matching Agreements (CMA)", "scf_control_id": "PRI-20.5", "crosswalks": { "NIST 800-53 R5.2": [ "PM-24", "PT-08" ] } }, { "principle_name": "Critical Business Functions", "description": "Ensure Technology Assets, Applications and/or Services (TAAS) that support organizational priorities are assessed so that critical assets are identified and key functional requirements communicated.", "scf_control": "Identify Critical Assets", "scf_control_id": "AST-05", "crosswalks": { "NIST 800-53 R5.2": [ "CP-02(08)" ], "NIST CSF 2.0": [ "GV.OC-04", "GV.OC-05", "ID.AM-05", "RC.RP", "RC.RP-02", "RC.RP-04" ], "NIST Privacy Framework 1.0": [ "ID.BE-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(7)(ii)(E)" ] } }, { "principle_name": "Critical Business Functions", "description": "Ensure Technology Assets, Applications and/or Services (TAAS) that support organizational priorities are assessed so that critical assets are identified and key functional requirements communicated.", "scf_control": "Criticality Analysis During Development", "scf_control_id": "TDA-05.1", "crosswalks": { "NIST 800-53 R5.2": [ "PM-30(01)", "RA-09", "SA-15(03)" ], "NIST CSF 2.0": [ "PR.PS-06" ], "NIST Privacy Framework 1.0": [ "ID.BE-P3" ], "USA California CCPA 2025": [ "7123(c)(14)" ] } }, { "principle_name": "Critical Business Functions", "description": "Ensure Technology Assets, Applications and/or Services (TAAS) that support organizational priorities are assessed so that critical assets are identified and key functional requirements communicated.", "scf_control": "Third-Party Criticality Assessments", "scf_control_id": "TPM-09", "crosswalks": { "NIST 800-53 R5.2": [ "PM-30(01)", "RA-09", "SA-09(03)" ], "NIST CSF 2.0": [ "GV.OC-04", "GV.OC-05", "GV.SC-04", "GV.SC-06", "GV.SC-07", "GV.SC-08", "ID.AM-05", "ID.RA-10" ], "NIST Privacy Framework 1.0": [ "ID.BE-P3" ], "USA Federal HIPAA Administrative Simplification 2013": [ "§ 164.308(a)(7)(ii)(E)" ], "USA California CCPA 2025": [ "7123(c)(15)" ] } }, { "principle_name": "Status Reporting To Governing Body", "description": "Provide governance oversight reporting and recommendations to those entrusted to make executive decisions about matters considered material to the organization's cybersecurity & data privacy program.", "scf_control": "Status Reporting To Governing Body", "scf_control_id": "GOV-09.1", "crosswalks": { "ISO 27701 2025": [ "5.1", "5.3(b)", "9.3.1" ], "NIST CSF 2.0": [ "GV.OV", "GV.OV-01", "GV.OV-03", "GV.SC", "GV.SC-09", "ID" ], "NIST Privacy Framework 1.0": [ "PR.PO-P6" ] } } ] }