# Security, Compliance & Resilience Management System (SCRMS) The SCRMS is the playbook to implement secure, compliant and resilient capabilities. The SCRMS also includes a prioritized implementation guide that answers the "Where do I start?" question about building a SCF-based cybersecurity and data protection program. The SCF’s holistic, technology-agnostic framework for designing, implementing, and maintaining secure, compliant, and resilient capabilities that covers an organization’s People, Processes, Technology, Data, and Facilities, regardless of how or where data is stored, processed, or transmitted. ## SCRMS Principles ### PDCA Phases Core Components Coverage Scope ## Overview ### A Holistic System for Secure, Compliant & Resilient Business Processes The Secure Controls Framework® (SCF) Security, Compliance & Resilience Management System (SCRMS) is intended to be utilized as a holistic, technology-agnostic framework for an entity to design, implement and maintain secure, compliant and resilient capabilities, covering an organization’s People, Processes, Technology, Data and Facilities (PPTDF), regardless of how or where data is stored, processed and/or transmitted. The SCRMS is not a “one-size-fits-all” playbook. It is designed to be adopted and tailored to the unique size, resources, and risk circumstances of each organization. The SCRMS expands upon and modernizes traditional Information Security Management System (ISMS) models, replacing siloed “management systems” with a single, unified operational framework that governs cybersecurity, data privacy, risk, and compliance together. Without an overarching concept of operations for the broader GRC function, organizations find that their governance, risk, compliance, and privacy teams operate in silos. Unfortunately, that approach produces unclear roles, duplicated effort, and gaps in coverage. The SCRMS directly solves this. The SCRMS enables an entity to align with one, or more, laws, regulations and/or frameworks. For example, an entity that aligns with NIST CSF 2.0, but also has obligations for PCI DSS, ISO 27001, ISO 42001, HIPAA Security Rule and SOC 2 can leverage a “living control set” that is capable of adjusting to the specific security, compliance and resilience requirements it must address. ## What Is The SCRMS? The SCRMS is designed to be: - **Framework-agnostic** by allowing entities to leverage one or more frameworks that it needs to align with (e.g., NIST CSF 2.0, SOC 2, NIST 800-171, ISO 27001, etc.); - **Process-focused** by supporting the people, processes, and practices that must exist for a cybersecurity program to operate effectively; - **Designed to function** by addressing strategic, operational, and tactical dimensions simultaneously; - **Supply-chain aware** by addressing both internal controls and Cybersecurity Supply Chain Risk Management (C-SCRM); - **Scalable** by tailoring from small businesses to large enterprises and government entities; - **Unified** by replacing siloed ISMS, AIMS, PIMS, and other fragmented management systems with one coherent model. ## SCRMS Goals ### What Does It Mean To Be Secure, Compliant & Resilient? The SCRMS defines specific, actionable meaning for each of its three pillars that goes above and beyond vague aspirations to concrete operational outcomes. ### Secure Being “secure” means the organization has implemented controls proportional to its risk profile across all five PPTDF dimensions. Security is not binary. It is a measurable, risk-based posture that evolves with threats and business context. This includes having defined policies, documented procedures, trained personnel, and verified technical controls that address the organization’s identified threats and vulnerabilities. ### Compliant Being “compliant” means the organization has identified all applicable Minimum Compliance Requirements (MCR) from laws, regulations, and contractual obligations. Compliance is demonstrated through evidence. Compliance is not a checkbox exercise. It requires ongoing monitoring, documentation, and audit readiness across every applicable legal and regulatory jurisdiction where the organization operates. ### Resilient Being “resilient” means the organization can absorb disruption, adapt to adverse events, and recover to normal operations within defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). Resilience encompasses business continuity, disaster recovery, incident response readiness, and supply chain resilience, ensuring the organization survives and learns from adverse events. ## Who Is the SCRMS For? Any organization using the SCF. The SCRMS is designed for any organization seeking to move beyond ad-hoc security practices to a structured, sustainable, and auditable cybersecurity program. ### Three Core Components of the SCRMS The SCRMS is built on three interlocking components that together form a complete implementation system. This spans the control catalog through to day-to-day operational governance. ### 01. Secure Controls Framework (SCF) The SCF is the foundational control catalog that is a comprehensive, open-source library of cybersecurity and data privacy controls covering all 33 domains. The SCF serves as the “What?” question to define the specific controls an organization needs to implement. ### 02. Security, Compliance & Resilience Management System (SCRMS) The SCRMS is the operational framework that defines “how” an organization builds and runs its cybersecurity program. It provides the governance model, principles, processes, and organizational accountability structures. ### 03. SCRMS-PIG: Prioritized Implementation Guide The SCRMS-PIG is a “how-to-GRC” playbook that serves as a step-by-step guide for prioritizing and sequencing SCRMS implementation based on an organization’s risk profile, maturity level, and compliance obligations. ## scope of coverage ### People, Processes, Technology, Data & Facilities The SCRMS is explicitly designed to address cybersecurity and data privacy holistically across all five dimensions of an organization, not just technology. - **People**: Training, awareness, hiring, HR security, insider threat, access governance - **Processes**: Policies, standards, procedures, change management, incident handling - **Technology**: Systems, networks, endpoints, cloud, applications, tooling, configurations - **Data**: Classification, handling, retention, privacy, encryption, data governance - **Facilities**: Physical security, environmental controls, data center access, visitor management ### SCRMS: Controls at the Center of Everything The SCRMS treats controls as the central nexus of cybersecurity and data privacy operations. Unlike traditional GRC which is often process-centric, the SCRMS is controls-centric, enabling every organizational function to map to a common control language. ### MCR: Minimum Compliance Requirements Controls that represent the minimum bar required by external obligations such as laws, regulations, and contracts. These are non-negotiable. Not implementing them creates legal or contractual exposure. - Externally influenced (laws, regs, contracts) - "Must have" requirements (e.g., non-discretionary) - Fact-finding, not risk assessment ### DSR: Discretionary Security Requirements Controls selected based on the organization's own risk appetite and judgment. These go beyond the minimum and represent best-practice enhancements driven by internal risk management. - Internally influenced (risk-based decisions) - "Nice to have" (e.g., risk-informed choices, discretionary) - Based on threat landscape and asset sensitivity ## A PDCA Approach to Cybersecurity Governance The SCRMS uses the Plan-Do-Check-Act (PDCA) cycle as its foundational operational model. It provides a logical way to design, build, operate, and improve a cybersecurity program over time. - **Plan**: Define scope, applicable laws, reg, frameworks, and risk appetite. Identify MCR and DSR. Select applicable SCF controls. Build your Minimum Security Requirements (MSR) blueprint. - **Do**: Implement selected controls. Publish policies, standards, and procedures. Assign stakeholder accountability. Leverage the SCRMS as a “paint by numbers” implementation guide. - **Check**: Assess control effectiveness via the SCF Conformity Assessment Program (SCF CAP). Measure maturity using the SCR-CMM. Monitor using built-in risk and threat catalogs. - **Act**: Remediate gaps from the Check phase. Update controls as laws change via the Living Control Set. Continuously improve.