# SCF API (sc2in/scf) > Source-faithful static JSON API for the Secure Controls Framework (SCF) v2026.3. 1591 controls, 34 families, 270 framework crosswalks, 45 threats, 65 risks, 6446 assessment objectives, and 422 evidence requests. All static JSON, no auth required. All data is static JSON. Append paths to the base URL. - `api/controls/{ID}.json` — single control (e.g., GOV-01) - `api/families/{CODE}.json` — family detail (e.g., GOV) - `api/crosswalks/{FW_ID}.json` — bidirectional crosswalk - `api/threats/{ID}.json` — single threat (e.g., NT-1) - `api/risks/{ID}.json` — single risk (e.g., R-AC-1) - `api/assessment-objectives/{SCF_ID}.json` — AOs for a control - `api/evidence-requests/{ERL_ID}.json` — evidence request (e.g., E-GOV-01) - `api/compensating-controls/{SCF_ID}.json` — compensating controls ## Endpoints - [summary](api/summary.json): Version, all counts, weight distribution. - [controls](api/controls.json): All controls with full metadata and crosswalks. - [families](api/families.json): Family index. - [crosswalks](api/crosswalks.json): Framework index. - [threats](api/threats.json): Threat catalog. - [risks](api/risks.json): Risk catalog. - [assessment-objectives](api/assessment-objectives.json): All assessment objectives. - [evidence-requests](api/evidence-requests.json): Evidence request list. - [compensating-controls](api/compensating-controls.json): Compensating control guidance. - [privacy-principles](api/privacy-principles.json): Data privacy management principles. - [legacy-map](api/legacy-map.json): Old→new control ids, SCF 2026.2 → 2026.3. ## Documentation - [API Reference](api/docs.md): Endpoint reference. - [Complete Documentation](llms-full.txt): Everything in one file. Data: Control identifiers, titles, and crosswalk references from the Secure Controls Framework (SCF), https://securecontrolsframework.com, licensed CC BY-ND 4.0. --- # SCF API Reference Static JSON API for the [Secure Controls Framework](https://securecontrolsframework.com) (SCF) v2026.3, maintained by SC2 (sc2in/scf). - **1591** controls across **34** families - **270** framework crosswalks - **45** threats, **65** risks - **6446** assessment objectives, **422** evidence requests - **1397** compensating controls, **263** privacy principles - All static JSON, no auth, CC BY-ND. ## Endpoints ### summary `GET api/summary.json` — Version, all counts, weight distribution. ### controls `GET api/controls.json` — All controls with full metadata and crosswalks. ### families `GET api/families.json` — Family index. ### crosswalks `GET api/crosswalks.json` — Framework index. ### threats `GET api/threats.json` — Threat catalog. ### risks `GET api/risks.json` — Risk catalog. ### assessment-objectives `GET api/assessment-objectives.json` — All assessment objectives. ### evidence-requests `GET api/evidence-requests.json` — Evidence request list. ### compensating-controls `GET api/compensating-controls.json` — Compensating control guidance. ### privacy-principles `GET api/privacy-principles.json` — Data privacy management principles. ### legacy-map `GET api/legacy-map.json` — Old→new control ids, SCF 2026.2 → 2026.3. ## Detail endpoints - `GET api/controls/{ID}.json` — single control (e.g., GOV-01) - `GET api/families/{CODE}.json` — family detail (e.g., GOV) - `GET api/crosswalks/{FW_ID}.json` — bidirectional crosswalk - `GET api/threats/{ID}.json` — single threat (e.g., NT-1) - `GET api/risks/{ID}.json` — single risk (e.g., R-AC-1) - `GET api/assessment-objectives/{SCF_ID}.json` — AOs for a control - `GET api/evidence-requests/{ERL_ID}.json` — evidence request (e.g., E-GOV-01) - `GET api/compensating-controls/{SCF_ID}.json` — compensating controls ## Families | code | family | controls | |---|---|---| | AAT | Artificial Intelligence & Autonomous Technologies | 160 | | AST | Asset Management | 64 | | BCD | Business Continuity & Disaster Recovery | 61 | | CAP | Capacity & Performance Planning | 8 | | CFG | Configuration Management | 58 | | CHG | Change Management | 20 | | CLD | Cloud Security | 19 | | CPL | Compliance | 48 | | CRY | Cryptographic Protections | 27 | | DCH | Data Classification & Handling | 94 | | EMB | Embedded Technology | 27 | | END | Endpoint Security | 31 | | GOV | Security, Compliance & Resilience Governance | 37 | | HRS | Human Resources Security | 45 | | IAC | Identification & Authentication | 123 | | IAO | Information Assurance | 17 | | IRO | Incident Response | 48 | | MDM | Mobile Device Management | 10 | | MNT | Maintenance | 29 | | MON | Continuous Monitoring | 76 | | NET | Network Security | 103 | | OPS | Security Operations | 11 | | PES | Physical & Environmental Security | 51 | | PRI | Data Privacy | 102 | | PRM | Project & Resource Management | 15 | | QTS | Quantum Security | 31 | | RSK | Risk Management | 35 | | SAT | Security Awareness & Training | 22 | | SEA | Secure Engineering & Architecture | 40 | | TDA | Technology Development & Acquisition | 74 | | THR | Threat Management | 17 | | TPM | Third-Party Management | 43 | | VPM | Vulnerability & Patch Management | 32 | | WEB | Web Security | 13 | Data: Control identifiers, titles, and crosswalk references from the Secure Controls Framework (SCF), https://securecontrolsframework.com, licensed CC BY-ND 4.0. --- ## Frameworks - `americas-arg-ppd-2018` — Argentina - Protection of Personal Data (2018) (78 SCF controls, 89 framework controls) - `americas-bhs-dpa-2003` — Bahamas - Data Protection Act (DPA) (2003) (42 SCF controls, 372 framework controls) - `americas-bmu-mba-coc-2020` — Bermuda - Bermuda Monetary Authority (BMA) Insurance Sector Operational Cyber Risk Management Code of Conduct (2020) (98 SCF controls, 84 framework controls) - `americas-bra-lgpd-2018` — Brazil - General Data Protection Law (LGPD) (2018) (30 SCF controls, 162 framework controls) - `americas-can-itsp-10-171-2025` — Canada - Protecting controlled information in non - Government of Canada systems and organizations (ITSP.10.171) (2025) (415 SCF controls, 280 framework controls) - `americas-can-osfi-b13-2022` — Canada - OSFI B - 13 (2022) (150 SCF controls, 77 framework controls) - `americas-can-osfi-self-assessment` — Canada - Office of the Superintendent of Financial Institutions Canada (OSFI) - Cyber Security Self - Assessment Guidance (126 SCF controls, 57 framework controls) - `americas-can-pipeda-2000` — Canada - Personal Information Protection and Electronic Documents Act (PIPEDA) (2000) (35 SCF controls, 68 framework controls) - `americas-chl-act-19628-1999` — Chile - Act 19628 - Protection of Personal Data (1999) (12 SCF controls, 15 framework controls) - `americas-col-law-1581-2012` — Colombia - Law 1581 (2012) (21 SCF controls, 60 framework controls) - `americas-mex-fdpa-2010` — Mexico - Federal Law on Protection of Personal Data held by Private Parties (2010) (23 SCF controls, 70 framework controls) - `apac-aus-cloud-controls-matrix-2026` — Australia - Cloud Controls Matrix (June 2026) (89 SCF controls, 49 framework controls) - `apac-aus-cop-sitc-2020` — Australia - Code of Practice - Securing the Internet of Things for Consumers (2020) (35 SCF controls, 13 framework controls) - `apac-aus-essential-8-2024` — Australia - Essential Eight maturity model and ISM mapping (2024) (60 SCF controls, 126 framework controls) - `apac-aus-ism-2026-june` — Australia - Information Security Manual (ISM) (June 2026) (412 SCF controls, 1076 framework controls) - `apac-aus-privacy-principles-2026` — Australia - Privacy Principles (2026) (25 SCF controls, 205 framework controls) - `apac-aus-ps-cps-230-2023` — Australia - Prudential Standard CPS 230 - Operational Risk Management (2023) (69 SCF controls, 98 framework controls) - `apac-aus-ps-cps-234-2019` — Australia - Prudential Standard CPS 234 Information Security (2019) (23 SCF controls, 37 framework controls) - `apac-aus-soci-2018` — Australia - Security of Critical Infrastructure Act 2018 (Compilation No. 9, 4 June 2026) (17 SCF controls, 22 framework controls) - `apac-chn-csnip-2012` — China - Decision on Strengthening Network Information Protection (2012) (7 SCF controls, 7 framework controls) - `apac-chn-cybersecurity-law-2017` — China - Cybersecurity Law of the People's Republic of China (2017) (27 SCF controls, 34 framework controls) - `apac-chn-data-security-law-2021` — China - Data Security Law of the People's Republic of China (2021) (10 SCF controls, 7 framework controls) - `apac-chn-pipl-2021` — China - Personal Information Protection Law of the People's Republic of China (2021) (37 SCF controls, 43 framework controls) - `apac-hkg-pdo-2022` — Hong Kong - Personal Data Ordinance (2022) (18 SCF controls, 256 framework controls) - `apac-ind-dpdpa-2023` — India Digital Personal Data Protection Act (2023) (41 SCF controls, 96 framework controls) - `apac-ind-privacy-rules-2011` — India - Information Technology Rules (Privacy Rules) (2011) (13 SCF controls, 31 framework controls) - `apac-ind-rbi-data-localization-2018` — Reserve Bank of India (RBI) - Storage of Payment System Data - Data Localization, 2018 (10 SCF controls, 4 framework controls) - `apac-ind-rbi-dpsc-2021` — Reserve Bank of India (RBI) - Master Direction on Digital Payment Security Controls, 2021 (166 SCF controls, 128 framework controls) - `apac-ind-rbi-pa-2025` — Reserve Bank of India (RBI) - Master Direction on Regulation of Payment Aggregators (PA) (2025) (69 SCF controls, 69 framework controls) - `apac-ind-rbi-ppi-2021` — Reserve Bank of India (RBI) - Master Direction on Prepaid Payment Instruments (PPI), 2021 (57 SCF controls, 84 framework controls) - `apac-ind-sebi-2024` — India - SEBI Cybersecurity and Cyber Resilience Framework (2024) (174 SCF controls, 129 framework controls) - `apac-jpn-appi-2020` — Japan - Act on the Protection of Personal Information (2020) (34 SCF controls, 106 framework controls) - `apac-jpn-ismap` — Japan - Information System Security Management and Assessment Program (ISMAP) (252 SCF controls, 1313 framework controls) - `apac-kor-pipa-2011` — South Korea - Personal Information Protection Act (PIPA) (2011) (25 SCF controls, 151 framework controls) - `apac-mys-bnm-rmit-2025` — Malaysia - Risk Management in Technology (RMiT) (2025) (374 SCF controls, 765 framework controls) - `apac-mys-pdpa-2010` — Malaysia - Personal Data Protection Act (PDPA) (2010) (20 SCF controls, 213 framework controls) - `apac-nzl-hisf-microsmall-2023` — New Zealand - HISF MicroSmall (2023) (33 SCF controls, 21 framework controls) - `apac-nzl-hisf-mlhsp-2023` — New Zealand - HISF MLHSP (2023) (108 SCF controls, 150 framework controls) - `apac-nzl-hisf-suppliers-2023` — New Zealand - HISO 10029:2024 NZ Health Information Security Framework Guidance for Suppliers (107 SCF controls, 68 framework controls) - `apac-nzl-ism-3-9` — New Zealand - Information Security Manual (ISM) v3.9 (306 SCF controls, 1382 framework controls) - `apac-nzl-privacy-act-2020` — New Zealand - Privacy Act (2020) (20 SCF controls, 160 framework controls) - `apac-phl-dpa-2012` — Philippines - Data Privacy Act (DPA) (2012) (16 SCF controls, 61 framework controls) - `apac-sgp-ccp-cii-2026` — Singapore - Cybersecurity Code of Practice for Critical Information Infrastructure (CCP CII) (2026) (258 SCF controls, 424 framework controls) - `apac-sgp-cyber-hygiene-practice-2019` — Singapore - Cyber Hygiene Practice (2019) (18 SCF controls, 11 framework controls) - `apac-sgp-mas-trm-2021` — Singapore - Monitory Authority of Singapore (MAS) Technology Risk Management (TRM) Guidelines (2021) (229 SCF controls, 279 framework controls) - `apac-sgp-pdpa-2012` — Singapore - Personal Data Protection Ac (PDPA) (2012) (33 SCF controls, 115 framework controls) - `apac-twn-pdpa-2025` — Taiwan - Personal Data Protection Act (PDPA) (2025) (9 SCF controls, 61 framework controls) - `emea-aut-dpa-2018` — Austria - Data Protection Act (2018) (28 SCF controls, 93 framework controls) - `emea-bel-act-30-2018` — Belgium - Act of 30 July 2018 (27 SCF controls, 105 framework controls) - `emea-che-fadp-2025` — Switzerland - Federal Act on Data Protection (FADP) (2025) (26 SCF controls, 105 framework controls) - `emea-che-finma-circ-23-1` — CHE - FINMA Circular 2023/1 - Operational Risks and Resilience - Banks (95 SCF controls, 89 framework controls) - `emea-deu-bsrit-2017` — Germany - Banking Supervisory Requirements for IT (2017) (92 SCF controls, 88 framework controls) - `emea-deu-c5-2026` — Germany - Cloud Computing Compliance Controls Catalogue (C5) (2026) (424 SCF controls, 1154 framework controls) - `emea-deu-fdpa-2017` — Germany - Federal Data Protection Act (2017) (47 SCF controls, 255 framework controls) - `emea-esp-ccn-stic-825-2026` — Spain - ICT Security Guide CCN - STIC 825 (2026) (233 SCF controls, 70 framework controls) - `emea-esp-decree-311-2022` — Spain - Royal Decree 311/2022 (76 SCF controls, 104 framework controls) - `emea-eu-ai-act-2024` — EU - European Union Artificial Intelligence Act (Regulation (EU) 2024/1689) (121 SCF controls, 281 framework controls) - `emea-eu-cyber-resilience-act-2024` — EU - European Union Cyber Resilience Act (2024) (35 SCF controls, 96 framework controls) - `emea-eu-cyber-resilience-act-annex-i-2024` — EU - European Union Cyber Resilience Act - Annex I (2024) (18 SCF controls, 24 framework controls) - `emea-eu-dora-2023` — EU - Digital Operational Resilience Act (2023) (106 SCF controls, 241 framework controls) - `emea-eu-dora-rts-2024` — EU - DORA Draft RTS on ICT Risk Management Framework and on Simplified ICT Risk Management Framework (JC 2023 86) (297 SCF controls, 428 framework controls) - `emea-eu-eba-ict-srm-2025` — EU - European Banking Authority Guidelines on ICT and Security Risk Management (2025) (160 SCF controls, 156 framework controls) - `emea-eu-gdpr-2016` — EU - European Union General Data Protection Regulation (2016) (43 SCF controls, 228 framework controls) - `emea-eu-nis2-2022` — EU - European Union Agency for Cybersecurity NIS2 Directive (EU) 2022/2555) (70 SCF controls, 30 framework controls) - `emea-eu-nis2-annex-2024` — EU - European Union Agency for Cybersecurity NIS2 Annex (2024) (235 SCF controls, 351 framework controls) - `emea-eu-psd2-2015` — EU - Second Payment Services Directive (PSD2) (2015) (11 SCF controls, 22 framework controls) - `emea-gbr-caf-4-0` — UK - Cyber Assessment Framework (CAF) v4.0 (68 SCF controls, 66 framework controls) - `emea-gbr-cap-1850-2020` — UK - Cyber Assessment Framework for Aviation Guidance (CAP1850) (2020) (36 SCF controls, 14 framework controls) - `emea-gbr-cyber-essentials-requirements-3-3` — UK - Cyber Essentials: Requirements for IT Infrastructure v3.3 (27 SCF controls, 32 framework controls) - `emea-gbr-def-stan-05-138-2024` — UK - Ministry of Defence Standard (DEFSTAN) 05 - 138 (2024) (218 SCF controls, 147 framework controls) - `emea-gbr-def-stan-05-138-l0-2024` — UK - Ministry of Defence Standard (DEFSTAN) 05 - 138 (2024) - L0 (2 SCF controls, 3 framework controls) - `emea-gbr-def-stan-05-138-l1-2024` — UK - Ministry of Defence Standard (DEFSTAN) 05 - 138 (2024) - L1 (162 SCF controls, 100 framework controls) - `emea-gbr-def-stan-05-138-l2-2024` — UK - Ministry of Defence Standard (DEFSTAN) 05 - 138 (2024) - L2 (211 SCF controls, 138 framework controls) - `emea-gbr-def-stan-05-138-l3-2024` — UK - Ministry of Defence Standard (DEFSTAN) 05 - 138 (2024) - L3 (217 SCF controls, 143 framework controls) - `emea-gbr-dpa-2018` — UK - Data Protection Act (DPA) (2018) (27 SCF controls, 367 framework controls) - `emea-grc-pirppd-1997` — Greece - Protection of Individuals with Regard to the Processing of Personal Data (2472/1997) (26 SCF controls, 73 framework controls) - `emea-hun-act-cxii-2011` — Hungary - Act CXII of 2011 (35 SCF controls, 100 framework controls) - `emea-irl-dpa-2018` — Ireland - Data Protection Act (DPA) (2018) (17 SCF controls, 46 framework controls) - `emea-isr-cmo-2-0` — Ireland - Cybersecurity Methodology for an Organization (CMO) v2.0 (68 SCF controls, 49 framework controls) - `emea-isr-ppl-5741-2025` — Israel - Protection of Privacy Law, 5741 (2025) (13 SCF controls, 18 framework controls) - `emea-ita-pdpc-2018` — Italy - Personal Data Protection Code (2018) (13 SCF controls, 45 framework controls) - `emea-ken-pda-2019` — Kenya - Data Protection Act (DPA) (2019) (42 SCF controls, 196 framework controls) - `emea-lux-cssf-20-750` — Commission de Surveillance du Secteur Financier (CSSF) Circular 20/750 - ICT Risk Management (2020) (187 SCF controls, 133 framework controls) - `emea-lux-cssf-22-806` — Commission de Surveillance du Secteur Financier (CSSF) Circular 22/806 (as amended by Circulars CSSF 25/883 and 26/915) - Outsourcing Arrangements (2022) (105 SCF controls, 369 framework controls) - `emea-nga-dpr-2019` — Nigeria - Data Protection Regulation (DPR) (2019) (32 SCF controls, 111 framework controls) - `emea-nor-pda-2018` — Norway - Personal Data Act (PDA) (2018) (4 SCF controls, 9 framework controls) - `emea-pol-act-10-2018` — Poland - Act of 10 May 2018 on the Protection of Personal Data (2 SCF controls, 3 framework controls) - `emea-qat-pdppl-2020` — Qatar - Personal Data Privacy Protection Law (PDPPL) (2020) (33 SCF controls, 40 framework controls) - `emea-rus-152-fz-2025` — Russia - Federal Law No. 152 - FZ (2025) (16 SCF controls, 21 framework controls) - `emea-sau-cgiot-2024` — Saudi Arabia - Cybersecurity Guidelines for Internet of Things (CGIoT - 1:2024) (126 SCF controls, 85 framework controls) - `emea-sau-cscc-1-2019` — Saudi Arabia - Critical Systems Cybersecurity Controls (CSCC - 1: 2019) (176 SCF controls, 109 framework controls) - `emea-sau-ecc-1-2018` — Saudi Arabia - Essential Cybersecurity Controls (ECC - 1 : 2018) (183 SCF controls, 208 framework controls) - `emea-sau-otcc-1-2022` — Saudi Arabia - Operational Technology Cybersecurity Controls (OTCC - 1: 2022) (171 SCF controls, 175 framework controls) - `emea-sau-pdpl-2023` — Saudi Arabia - Personal Data Protection Law (PDPL) (2023) (35 SCF controls, 70 framework controls) - `emea-sau-sacs-002-2022` — Saudi Arabia - SACS - 002 Third Party Cybersecurity Standard (2022) (106 SCF controls, 124 framework controls) - `emea-sau-sama-csf-1-2017` — Saudi Arabia - Saudi Arabian Monetary Authority (SAMA) Cyber Security Framework Version 1.0 (2017) (115 SCF controls, 486 framework controls) - `emea-srb-act-9-2018` — Serbia - Act of 9 November 2018 on Personal Data Protection (Official Gazette No. 87/18) (32 SCF controls, 330 framework controls) - `emea-tur-lppd-2016` — Turkey - Law on the Protection of Personal Data (LPPD) (2016) (8 SCF controls, 103 framework controls) - `emea-uae-niaf-2023` — UAE - National Information Assurance Framework (NIAF) (2023) (20 SCF controls, 15 framework controls) - `emea-zaf-popia-2013` — South Africa - Protection of Personal Information Act (POPIA) (2013) (26 SCF controls, 245 framework controls) - `general-aicpa-pmf-2020` — American Institute of Certified Public Accountants (AICPA) Privacy Management Framework (PMF) (2020) (111 SCF controls, 123 framework controls) - `general-aicpa-tsc-2017` — American Institute of Certified Public Accountants (AICPA) Trust Services Criteria (2017) (407 SCF controls, 399 framework controls) - `general-apec-privacy-framework-2015` — Asia - Pacific Economic Cooperation (APEC) Privacy Framework (2015) (14 SCF controls, 25 framework controls) - `general-bsi-200-1-1-0` — Bundesamt für Sicherheit in der Informationstechnik (BSI) - Standard 200 - 1 (v1.0) (35 SCF controls, 22 framework controls) - `general-cis-csc-8-1` — Center for Internet Security (CIS) Critical Security Controls (CSC) version 8.1 (242 SCF controls, 172 framework controls) - `general-cis-csc-8-1-ig1` — Center for Internet Security (CIS) Critical Security Controls (CSC) version 8.1 - IG1 (107 SCF controls, 56 framework controls) - `general-cis-csc-8-1-ig2` — Center for Internet Security (CIS) Critical Security Controls (CSC) version 8.1 - IG2 (214 SCF controls, 130 framework controls) - `general-cis-csc-8-1-ig3` — Center for Internet Security (CIS) Critical Security Controls (CSC) version 8.1 - IG3 (237 SCF controls, 153 framework controls) - `general-cobit-2019` — Control Objectives for Information and Related Technologies (COBIT) (2019) (196 SCF controls, 230 framework controls) - `general-coso-2013` — Committee of Sponsoring Organizations (COSO) (2013) (104 SCF controls, 17 framework controls) - `general-cr-cmm-2026` — Cyber Resilience Capability Maturity Model (CR - CMM) (2026) (50 SCF controls, 40 framework controls) - `general-csa-cmm-4-1-0` — Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) v4.1.0 (313 SCF controls, 207 framework controls) - `general-csa-iot-2` — Cloud Security Alliance (CSA) Internet of Things Security Controls Framework v2 (256 SCF controls, 155 framework controls) - `general-govramp` — Government Risk and Authorization Management Program (GovRAMP) (447 SCF controls, 383 framework controls) - `general-govramp-core` — Government Risk and Authorization Management Program (GovRAMP) - Core Controls (86 SCF controls, 60 framework controls) - `general-govramp-high` — Government Risk and Authorization Management Program (GovRAMP) - High (447 SCF controls, 383 framework controls) - `general-govramp-low` — Government Risk and Authorization Management Program (GovRAMP) - Low (171 SCF controls, 114 framework controls) - `general-govramp-low-plus` — Government Risk and Authorization Management Program (GovRAMP) - Low+ (235 SCF controls, 173 framework controls) - `general-govramp-mod` — Government Risk and Authorization Management Program (GovRAMP) - Moderate (350 SCF controls, 290 framework controls) - `general-iec-62443-2-1-2024` — International Electrotechnical Commission (IEC) 62443 - 2 - 1:2024 - Security for industrial automation and control systems - Part 2 - 1: Security program requirements for IACS asset owners (112 SCF controls, 119 framework controls) - `general-iec-62443-3-3-2013` — International Electrotechnical Commission (IEC) 62443 - 3 - 3:2013 - Industrial communication networks - Network and system security - Part 3 - 3: System security requirements and security levels (80 SCF controls, 111 framework controls) - `general-iec-62443-4-1-2018` — International Electrotechnical Commission (IEC) 62443 - 4 - 1:2018 - Security for industrial automation and control systems - Part 4 - 1: Secure product development lifecycle requirements (25 SCF controls, 186 framework controls) - `general-iec-62443-4-2-2019` — International Electrotechnical Commission 62443 - 4 - 2 Ed. 1.0 b:2019 - Security for industrial automation and control systems - Part 4 - 2: Technical security requirements for IACS components (89 SCF controls, 169 framework controls) - `general-iec-tr-60601-4-5-2021` — International Electrotechnical Commission (IEC) Technical Report 60601 - 4 - 5:2021 - Medical electrical equipment - Part 4 - 5: Guidance and interpretation - Safety - related technical security specifications (26 SCF controls, 37 framework controls) - `general-imo-maritime-cyber-risk-management-2025` — International Maritime Organization (IMO) Guidelines on Maritime Cyber Risk Management (2025) (76 SCF controls, 35 framework controls) - `general-iso-21434-2021` — ISO/SAE 21434:2021 - Road vehicles - Cybersecurity engineering (51 SCF controls, 232 framework controls) - `general-iso-22301-2019` — ISO/IEC 22301:2019 - Security and resilience - Business continuity management systems - Requirements (36 SCF controls, 259 framework controls) - `general-iso-27001-2022` — ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection - Information security management systems - Requirements (51 SCF controls, 148 framework controls) - `general-iso-27002-2022` — ISO/IEC 27002:2022 - Information security, cybersecurity and privacy protection - Information security controls (314 SCF controls, 96 framework controls) - `general-iso-27017-2015` — ISO/IEC 27017:2015 - Information technology - Security techniques - Code of practice for information security controls based on ISO/IEC 27002 for cloud services (224 SCF controls, 118 framework controls) - `general-iso-27018-2025` — ISO/IEC 27018:2025 - Information security, cybersecurity and privacy protection - Guidelines for protection of personally identifiable information (PII) in public clouds acting as PII processors (320 SCF controls, 108 framework controls) - `general-iso-27701-2025` — ISO/IEC 27701:2025 - Information security, cybersecurity and privacy protection - Privacy information management systems - Requirements and guidance (59 SCF controls, 90 framework controls) - `general-iso-29100-2024` — ISO/IEC 29100:2024 - Information technology - Security techniques - Privacy framework (43 SCF controls, 11 framework controls) - `general-iso-31000-2018` — ISO/IEC 31000:2018 - Risk management - Guidelines (53 SCF controls, 27 framework controls) - `general-iso-31010-2009` — ISO/IEC 31010:2019 - Risk management - Risk assessment techniques (31 SCF controls, 32 framework controls) - `general-iso-42001-2023` — ISO/IEC 42001:2023 - Information technology - Artificial intelligence - Management system (149 SCF controls, 140 framework controls) - `general-mitre-att_ck-16-1` — MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) - NIST 800 - 53 mappings (113 SCF controls, 511 framework controls) - `general-mpa-csbp-5-3-1` — Motion Picture Association (MPA) Content Security Best Practices Common Guidelines v5.3.1 (234 SCF controls, 81 framework controls) - `general-naic-insurance-data-security-model-law-668-2017` — National Association of Insurance Commissioners (NAIC) Insurance Data Security Model Law (MDL - 668) (2017) (58 SCF controls, 85 framework controls) - `general-nist-100-1-ai-rmf` — NIST AI 100 - 1 - Artificial Intelligence Risk Management Framework (AI RMF 1.0) (158 SCF controls, 91 framework controls) - `general-nist-600-1-gen-ai-profile` — NIST AI 600 - 1 - Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (140 SCF controls, 250 framework controls) - `general-nist-800-160-vol-2-r1` — NIST SP 800 - 160 Volume 2, Revision 1 - Developing Cyber - Resilient Systems: A Systems Security Engineering Approach (207 SCF controls, 201 framework controls) - `general-nist-800-161-r1` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (350 SCF controls, 308 framework controls) - `general-nist-800-161-r1-cscrm` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - C - SCRM Baseline (137 SCF controls, 95 framework controls) - `general-nist-800-161-r1-flowdown` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - Flow Down Baseline (110 SCF controls, 69 framework controls) - `general-nist-800-161-r1-level-1` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - Level 1 Baseline (102 SCF controls, 76 framework controls) - `general-nist-800-161-r1-level-2` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - Level 2 Baseline (282 SCF controls, 236 framework controls) - `general-nist-800-161-r1-level-3` — NIST SP 800 - 161 R1 UDP1 - Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations - Level 3 Baseline (289 SCF controls, 251 framework controls) - `general-nist-800-171-r2` — NIST SP 800 - 171 R2 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (261 SCF controls, 172 framework controls) - `general-nist-800-171-r3` — NIST SP 800 - 171 R3 - Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (414 SCF controls, 276 framework controls) - `general-nist-800-171a` — NIST SP 800 - 171A - Assessing Security Requirements for Controlled Unclassified Information (137 SCF controls, 320 framework controls) - `general-nist-800-171a-r3` — NIST SP 800 - 171A R3 - Assessing Security Requirements for Controlled Unclassified Information (413 SCF controls, 509 framework controls) - `general-nist-800-172-r3` — NIST SP 800 - 172 R3 - Enhanced Security Requirements for Protecting Controlled Unclassified Information (161 SCF controls, 103 framework controls) - `general-nist-800-172a-r3` — NIST SP 800 - 172A R3 - Assessing Enhanced Security Requirements for Controlled Unclassified Information (167 SCF controls, 364 framework controls) - `general-nist-800-207` — NIST SP 800 - 207 - Zero Trust Architecture (92 SCF controls, 7 framework controls) - `general-nist-800-218` — NIST SP 800 - 218 - Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities (60 SCF controls, 60 framework controls) - `general-nist-800-37-r2` — NIST SP 800 - 37 R2 - Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (47 SCF controls, 47 framework controls) - `general-nist-800-39` — NIST SP 800 - 39 - Managing Information Security Risk: Organization, Mission, and Information System View (18 SCF controls, 16 framework controls) - `general-nist-800-53-r4` — NIST SP 800 - 53 R4 - Security and Privacy Controls for Federal Information Systems and Organizations (640 SCF controls, 682 framework controls) - `general-nist-800-53-r5-2` — NIST SP 800 - 53 R5 - Security and Privacy Controls for Information Systems and Organizations (776 SCF controls, 831 framework controls) - `general-nist-800-53-r5-2-high` — NIST SP 800 - 53 R5 - Security and Privacy Controls for Information Systems and Organizations - High Baseline (427 SCF controls, 369 framework controls) - `general-nist-800-53-r5-2-low` — NIST SP 800 - 53 R5 - Security and Privacy Controls for Information Systems and Organizations - Low Baseline (207 SCF controls, 149 framework controls) - `general-nist-800-53-r5-2-mod` — NIST SP 800 - 53 R5 - Security and Privacy Controls for Information Systems and Organizations - Moderate Baseline (349 SCF controls, 287 framework controls) - `general-nist-800-53-r5-2-privacy` — NIST SP 800 - 53 R5 - Security and Privacy Controls for Information Systems and Organizations - Privacy Baseline (128 SCF controls, 96 framework controls) - `general-nist-800-66-r2` — NIST SP 800 - 66 R2 - Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide (113 SCF controls, 22 framework controls) - `general-nist-800-82-r3` — NIST SP 800 - 82 R3 - Guide to Operational Technology (OT) Security - Low OT Overlay (776 SCF controls, 831 framework controls) - `general-nist-800-82-r3-high` — NIST SP 800 - 82 R3 - Guide to Operational Technology (OT) Security - High OT Overlay (484 SCF controls, 419 framework controls) - `general-nist-800-82-r3-low` — NIST SP 800 - 82 R3 - Guide to Operational Technology (OT) Security - Low OT Overlay (262 SCF controls, 194 framework controls) - `general-nist-800-82-r3-mod` — NIST SP 800 - 82 R3 - Guide to Operational Technology (OT) Security - Moderate OT Overlay (404 SCF controls, 338 framework controls) - `general-nist-csf-2-0` — NIST Cybersecurity Framework v2.0 (251 SCF controls, 134 framework controls) - `general-nist-cswp-39` — NIST CSWP 39 - Considerations for Achieving Crypto Agility (15 SCF controls, 18 framework controls) - `general-nist-privacy-framework-1-0` — NIST Privacy Framework v1.0 (154 SCF controls, 123 framework controls) - `general-oecd-privacy-principles-2010` — Organisation for Economic Co - operation and Development (EOCD) Privacy Principles (14 SCF controls, 17 framework controls) - `general-owasp-top-10-2025` — Open Worldwide Application Security Project (OWASP) Top 10 (2025) (137 SCF controls, 10 framework controls) - `general-pci-dss-4-0-1` — Payment Card Industry Data Security Standard (PCI DSS) v4.01 (369 SCF controls, 351 framework controls) - `general-pci-dss-4-0-1-saq-a` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) A (70 SCF controls, 29 framework controls) - `general-pci-dss-4-0-1-saq-a-ep` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) A - EP (239 SCF controls, 139 framework controls) - `general-pci-dss-4-0-1-saq-b` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) B (58 SCF controls, 27 framework controls) - `general-pci-dss-4-0-1-saq-b-ip` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) B - IP (120 SCF controls, 50 framework controls) - `general-pci-dss-4-0-1-saq-c` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) C (229 SCF controls, 124 framework controls) - `general-pci-dss-4-0-1-saq-c-vt` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) C - VT (112 SCF controls, 54 framework controls) - `general-pci-dss-4-0-1-saq-d-merchant` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) D Merchant (320 SCF controls, 233 framework controls) - `general-pci-dss-4-0-1-saq-d-service-provider` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) D Service Provider (337 SCF controls, 257 framework controls) - `general-pci-dss-4-0-1-saq-p2pe` — Payment Card Industry Data Security Standard (PCI DSS) v4.0.1 - Self - Assessment Questionnaire (SAQ) P2PE (47 SCF controls, 21 framework controls) - `general-scf-dpmp-2026` — Secure Controls Framework (SCF) Data Privacy Management Principles (2026) (223 SCF controls, 86 framework controls) - `general-shared-assessments-sig-2025` — Shared Assessments Standard Information Gathering (SIG) Questionnaire 2025 (127 SCF controls, 65 framework controls) - `general-sparta-4-0` — SPARTA Countermeasure (4.0) (79 SCF controls, 53 framework controls) - `general-swift-cscf-2025` — Society for Worldwide Interbank Financial Telecommunication Customer Security Controls Framework 2025 (164 SCF controls, 32 framework controls) - `general-tisax-6-0-3` — Trusted Information Security Assessment Exchange (TISAX) 6.0.3 (155 SCF controls, 74 framework controls) - `general-ul-2900-1-2017` — UL 2900 - 1 - Software Cybersecurity for Network - Connectable Products, Part 1: General Requirements (2017) (23 SCF controls, 143 framework controls) - `general-ul-2900-2-2-2016` — UL 2900 - 2 - 2 Ed. 1 - 2016 - Outline of Investigation for Software Cybersecurity for Network - Connectable Products, Part 2 - 2: Particular Requirements for Industrial Control Systems (20 SCF controls, 57 framework controls) - `general-un-155-2021` — United Nations - Regulation No. 155 - Cyber security and cyber security management system (2021) (57 SCF controls, 55 framework controls) - `general-un-ece-wp-29-2020` — United Nations - United Nations Economic Commission for Europe (UNECE) Working Party 29 (2020) (57 SCF controls, 54 framework controls) - `usa-federal-cms-marse-2-0` — USA - Centers for Medicare & Medicaid Services MARS - E Document Suite, Version 2.0 (402 SCF controls, 1282 framework controls) - `usa-federal-dhs-cisa-cpg-2-0` — USA - Cybersecurity & Infrastructure Security Agency (CISA) Cross - Sector Cybersecurity Performance Goals 2.0 (126 SCF controls, 38 framework controls) - `usa-federal-dhs-cisa-ssdaf-2024` — USA - Cybersecurity & Infrastructure Security Agency (CISA) Secure Software Development Attestation Form (SSDAF) (2024) (41 SCF controls, 15 framework controls) - `usa-federal-dhs-cisa-tic-3-0` — USA - Cybersecurity & Infrastructure Security Agency (CISA) Trusted Internet Connections 3.0 Security Capabilities Catalog (153 SCF controls, 117 framework controls) - `usa-federal-doc-data-privacy-framework-2023` — USA - Data Privacy Framework (2023) (32 SCF controls, 75 framework controls) - `usa-federal-doe-c2m2-2-1` — USA - Department of Energy (DOE) - Cybersecurity Capability Maturity Model version 2.1 (231 SCF controls, 356 framework controls) - `usa-federal-dow-brilliant-basics-it` — USA - DoW Brilliant at the Basics: Top 10 IT Cybersecurity Best Practices for DIB Partners (38 SCF controls, 10 framework controls) - `usa-federal-dow-brilliant-basics-ot` — USA - DoW Brilliant at the Basics: Top 10 OT Cybersecurity Best Practices for DIB Partners (58 SCF controls, 10 framework controls) - `usa-federal-dow-cert-rmm-1-2` — USA - Department of War (DoW) - Computer Emergency Response Team (CERT) Resilience Management Model (RMM) Version 1.2 (96 SCF controls, 753 framework controls) - `usa-federal-dow-cmmc-2-level-1` — USA - Department of War (DoW) - Cybersecurity Maturity Model Certification (CMMC) v2.0 - Level 1 (52 SCF controls, 15 framework controls) - `usa-federal-dow-cmmc-2-level-1-aos` — USA - Department of War (DoW) - Cybersecurity Maturity Model Certification (CMMC) v2.0 - Level 1 Assessment Objectives (16 SCF controls, 59 framework controls) - `usa-federal-dow-cmmc-2-level-2` — USA - Department of War (DoW) - Cybersecurity Maturity Model Certification (CMMC) v2.0 - Level 2 (200 SCF controls, 110 framework controls) - `usa-federal-dow-cmmc-2-level-3` — USA - Department of War (DoW) - Cybersecurity Maturity Model Certification (CMMC) v2.0 - Level 3 (55 SCF controls, 24 framework controls) - `usa-federal-dow-dfars-252-204-7012` — USA - Defense Federal Acquisition Regulation Supplement (DFARS) 252.204 - 7012 (19 SCF controls, 20 framework controls) - `usa-federal-dow-safeguarding-nnpi-2010` — USA - Safeguarding of Naval Nuclear Propulsion Information (NNPI) (2010) (32 SCF controls, 68 framework controls) - `usa-federal-dow-zt-roadmap-1-1` — USA - Department of War (DoW) - Zero Trust Execution Roadmap v1.1 (119 SCF controls, 192 framework controls) - `usa-federal-dow-zta-reference-architecture-2-0` — USA - Department of War (DoW) - Zero Trust Reference Architecture v2 (40 SCF controls, 28 framework controls) - `usa-federal-eo-14028` — USA - Executive Order (EO) 14028 - Improving the Nation's Cybersecurity (43 SCF controls, 16 framework controls) - `usa-federal-far-52-204-21` — USA - Federal Acquisition Regulation (FAR) 52.204 - 21 - Basic Safeguarding of Covered Contractor Information Systems (59 SCF controls, 17 framework controls) - `usa-federal-far-52-204-25` — USA - Federal Acquisition Regulation (FAR) 52.204 - 25 (NDAA Section 889) - Prohibition on Contracting With Entities Using Certain Telecommunications and Video Surveillance Services or Equipment (2 SCF controls, 5 framework controls) - `usa-federal-far-52-204-27` — USA - Federal Acquisition Regulation (FAR) 52.204 - 27 - Prohibition on a ByteDance Covered Application (3 SCF controls, 2 framework controls) - `usa-federal-fbi-cjis-6-0` — US - Department of Justice - Criminal Justice Information Services (CJIS) Security Policy v6.0 (366 SCF controls, 319 framework controls) - `usa-federal-fda-21-cfr-part-11-2025` — USA - Food & Drug Administration (FDA) 21 CFR Part 11 (2025) (62 SCF controls, 28 framework controls) - `usa-federal-ffiec-iteh-2016` — USA - FFIEC IT Examination Handbook - Information Security (September 2016) (184 SCF controls, 57 framework controls) - `usa-federal-gsa-fedramp-5-high` — USA - Federal Risk and Authorization Management Program (FedRAMP) R5 - High Baseline (469 SCF controls, 410 framework controls) - `usa-federal-gsa-fedramp-5-li-saas` — USA - Federal Risk and Authorization Management Program (FedRAMP) R5 - LI-SaaS Baseline (195 SCF controls, 138 framework controls) - `usa-federal-gsa-fedramp-5-low` — USA - Federal Risk and Authorization Management Program (FedRAMP) R5 - Low Baseline (216 SCF controls, 156 framework controls) - `usa-federal-gsa-fedramp-5-mod` — USA - Federal Risk and Authorization Management Program (FedRAMP) R5 - Moderate Baseline (384 SCF controls, 323 framework controls) - `usa-federal-hhs-45-cfr-155-260-2016` — USA - Health and Human Services (HHS) § 155.260 - Privacy and Security of Personally Identifiable Information (2016) (36 SCF controls, 44 framework controls) - `usa-federal-irs-1075-2021` — USA - Internal Revenue Service (IRS) 1075 (2021) (454 SCF controls, 730 framework controls) - `usa-federal-law-33-cfr-part-101-subpart-f` — USA - 33 CFR Part 101 Subpart F (up to date as of 4 - 17 - 2026) (105 SCF controls, 148 framework controls) - `usa-federal-law-coppa-2024` — USA - Children's Online Privacy Protection Act (COPPA) (2024) (10 SCF controls, 8 framework controls) - `usa-federal-law-facta-fcra-2023` — USA - Fair & Accurate Credit Transactions Act (FACTA) & Fair Credit Reporting Act (FCRA) (2023) (3 SCF controls, 6 framework controls) - `usa-federal-law-ferpa-2010` — USA - Family Educational Rights and Privacy Act (FERPA) (2010) (5 SCF controls, 27 framework controls) - `usa-federal-law-ftc-act-1938` — USA - Federal Trade Commission (FTC) Act (16 SCF controls, 1 framework controls) - `usa-federal-law-glba-cfr-314-2023` — USA - Gramm Leach Bliley Act (GLBA) - CFR 314 (Dec 2023) (69 SCF controls, 53 framework controls) - `usa-federal-law-hipaa-security-rule-2013` — USA - Health Insurance Portability and Accountability Act (HIPAA) Security Rule (2013) (137 SCF controls, 87 framework controls) - `usa-federal-law-hipaa-simplification-2013` — USA - Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification (2013) (171 SCF controls, 575 framework controls) - `usa-federal-law-sox-2002` — USA - Sarbanes Oxley Act (SOX) (2002) (4 SCF controls, 17 framework controls) - `usa-federal-nerc-cip-2024` — USA - North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) (2024) (124 SCF controls, 204 framework controls) - `usa-federal-nispom-2020` — USA - National Industrial Security Program Operating Manual (NISPOM) (2020) (40 SCF controls, 230 framework controls) - `usa-federal-nrc-10-cfr-73-54-2015` — USA - NRC 10 CFR 73.54 (34 SCF controls, 33 framework controls) - `usa-federal-nsf-rig-2025-information-assurance` — USA - NSF Research Infrastructure Guide (January 2025) - Sections 5.2-5.3 (Cyberinfrastructure & Information Assurance) (42 SCF controls, 34 framework controls) - `usa-federal-omb-fipps-1973` — USA - Fair Information Practice Principles (FIPPs) (1973) (30 SCF controls, 8 framework controls) - `usa-federal-sec-cybersecurity-rule-2023` — USA - Securities and Exchange Commission (SEC) Cybersecurity Rule (2023) (41 SCF controls, 16 framework controls) - `usa-federal-sro-fca-crm-2023` — USA - Farm Credit Administration (FCA) Cyber Risk Management (2023) (81 SCF controls, 34 framework controls) - `usa-federal-sro-finra-2007` — USA - Financial Industry Regulatory Authority (FINRA) Cybersecurity Rules (18 SCF controls, 41 framework controls) - `usa-federal-tsa-sd-pipeline-2021-02f` — USA - TSA Security Directive Pipeline-2021-02F (72 SCF controls, 67 framework controls) - `usa-federal-tsa-security-directive-1580-82-2022-01` — USA - Transportation Security Administration (TSA) Security Directive 1580/82 - 2022 - 01 - Rail Cybersecurity Mitigation Actions and Testing (61 SCF controls, 68 framework controls) - `usa-state-ak-pipa-2009` — USA - Alaska Personal Information Protection Act (PIPA) (2009) (5 SCF controls, 25 framework controls) - `usa-state-ca-ccpa-cpra-2026` — USA - California Consumer Privacy Act (CCPA) (January 2026) - amended California Privacy Rights Act (CPRA) (259 SCF controls, 623 framework controls) - `usa-state-ca-sb1386-2002` — USA - California SB1386 (2002) (4 SCF controls, 6 framework controls) - `usa-state-ca-sb327-2018` — USA - California SB327 (2018) (3 SCF controls, 7 framework controls) - `usa-state-co-privacy-act-2021` — USA - Colorado Privacy Act (2021) (23 SCF controls, 52 framework controls) - `usa-state-il-bipa-2008` — USA - Illinois Biometric Information Privacy Act (BIPA) (2008) (6 SCF controls, 12 framework controls) - `usa-state-il-ipa-2009` — USA - Illinois Identity Protection Act (IPA) (2009) (12 SCF controls, 33 framework controls) - `usa-state-il-pipa-2006` — USA - Illinois Personal Information Protection Act (PIPA) (2006) (9 SCF controls, 53 framework controls) - `usa-state-ma-201-cmr-17-2008` — USA - Massachusetts 201 CMR 17.00 (2008) (53 SCF controls, 37 framework controls) - `usa-state-mt-cdpa-2025` — USA - Montana Consumer Data Privacy Act (CDPA) (2025) (70 SCF controls, 98 framework controls) - `usa-state-nv-privacy-law-2023` — USA - Nevada Privacy Law (2023) - CHAPTER 603A - SECURITY AND PRIVACY OF PERSONAL INFORMATION (28 SCF controls, 121 framework controls) - `usa-state-nv-regulation-5-2024` — USA - Nevada Operation of Gaming Establishments - Regulation 5.260 (Cybersecurity) (20 SCF controls, 11 framework controls) - `usa-state-nv-sb220-2019` — USA - Nevada SB220 (2019) (3 SCF controls, 4 framework controls) - `usa-state-ny-dfs-23-nycrr500-2023-amd2` — USA - New York Department of Financial Services (NY DFS) 23NYCRR Part 500 (2023 Amendment 2) (158 SCF controls, 145 framework controls) - `usa-state-ny-shield-act-2019` — USA - New York SHIELD Act (SB S5575B) (2019) (27 SCF controls, 45 framework controls) - `usa-state-or-cpa-2023` — USA - Oregon Consumer Privacy Act (SB 619) (2023) (34 SCF controls, 75 framework controls) - `usa-state-or-ors-646a-2025` — USA - Oregon Consumer Information Protection Act (ORS 646A) (2025) (24 SCF controls, 97 framework controls) - `usa-state-tn-tipa-2025` — USA - Tennessee Information Protection Act (TIPA) (2025) (29 SCF controls, 76 framework controls) - `usa-state-tx-bc521-2009` — USA - Texas Identity Theft Enforcement and Protection Act (BC521) (2009) (6 SCF controls, 27 framework controls) - `usa-state-tx-cdpa-2025` — USA - Texas Consumer Data Protection Act (2025) (28 SCF controls, 89 framework controls) - `usa-state-tx-dir-security-control-standards-catalog-2-2` — USA - Texas DIR Security Control Standards Catalog v2.2 (246 SCF controls, 229 framework controls) - `usa-state-tx-sb2610-2025` — USA - Texas Safe Harbor Law (SB2610) (2025) (6 SCF controls, 33 framework controls) - `usa-state-tx-sb820-2019` — USA - Texas SB820 (2019) (4 SCF controls, 7 framework controls) - `usa-state-tx-traiga-2025` — USA - Texas Responsible Artificial Intelligence Governance Act (TRAIGA) - H.B. 149 (33 SCF controls, 44 framework controls) - `usa-state-tx-txramp-2-0-level-1` — USA - Texas Risk & Authorization Management Program 2.0 - Level 1 (177 SCF controls, 117 framework controls) - `usa-state-tx-txramp-2-0-level-2` — USA - Texas Risk & Authorization Management Program 2.0 - Level 2 (289 SCF controls, 223 framework controls) - `usa-state-va-cdpa-2023` — USA - Virginia Consumer Data Protection Act (2023) (43 SCF controls, 64 framework controls) - `usa-state-vt-act-171-2018` — USA - Vermont Data Broker Registration Act (Act 171 of 2018) (36 SCF controls, 61 framework controls)