SCF Scoping Tool¶
The Secure Controls Framework maps 1,534 controls to 252 laws, regulations and frameworks across 44 countries — the counts as at the release this was built against, which the Council moves every release (the site currently advertises "1,500+ controls" and "200+ frameworks"). The builder reads the version out of the sheet name, so it follows your download rather than these figures. Almost nobody needs all 252. This turns "where do you operate and what business are you in" into a scoped control set — with the legal basis for every control it keeps.
It is a builder, not a download. You fetch the SCF free from the Secure Controls Framework Council, run one command, and the workbook is assembled on your machine. Nothing derived from the SCF passes through this site — see Licensing for why that distinction matters.
Artefact type: scoping tool + assessment workbook
Macro-free .xlsx. Built and tested in LibreOffice Calc 26.2. No macros, no dynamic-array formulas, so it also opens in Excel 2016 and later, Google Sheets and Excel Online.
The post that goes with this tool: Nobody knows how to scope a control framework.
The gap it fills¶
Open the official SCF workbook and scroll right past the mapping columns. Three columns sit there empty in every release: Minimum Security Requirements, MCR and DSR.
They are empty on purpose. The SCF Council's model is that you decide your scope first — which laws bind you, which frameworks you have chosen — and those columns record the answer. It is the single most consequential decision in the whole exercise, and the framework quite reasonably leaves it to you.
Nobody automates it. So most people either scope by hand in a meeting and write it down nowhere, or quietly adopt all 1,534 controls and call it thorough. This tool does the derivation and shows its working.
What you get¶
Sixteen sheets. The ones ending in b show only what applies to you — no filter to apply, no button to press. Change the scope and they rebuild themselves.
| Sheet | What it does |
|---|---|
| 1 · Scope | Set your country, sectors, organisation size and target maturity. The 252-document registry auto-ticks; ADD and DROP override it, and DROP wins. |
| 1b · Your obligations | Just the instruments you selected, compacted. |
| 2 · My Controls | All 1,534 controls with an in-scope flag, a count of how many binding and how many voluntary obligations drive each one, and the SCF's solution text and maturity criteria filtered to your org size and target level. |
| 2b · Controls that apply | Only the in-scope controls. |
| 3 · Control Detail | Answers "why is this control in scope?" — names the specific instruments driving it, with links to the SCF's published mapping evidence. The picker lists in-scope controls only. |
| 4 · Assessment / 4b | 5,963 assessment objectives, with working columns for status, assessor, date and evidence. |
| 5 · Evidence / 5b | The 316-item evidence request list, reduced to what your scope requires. |
| 6 · Compensating / 6b | What to fall back on when a control can't be implemented, and the risk you carry if you do neither. |
| 7 · Dashboard | Coverage by domain, by NIST CSF function, by materiality weighting. |
| 8 · Coverage | A tile map of all 42 jurisdictions the SCF covers — your country in accent, EU member states in teal when EU law is on. Plus regional coverage and a "what cannot slip" block. |
Two more things come out of the same command: a coverage map as a standalone HTML page, and a scope report as a PDF documenting your scope and its legal basis.
Sectors are not capped¶
Three dropdowns get you started, but the tick list above the registry carries every sector the framework touches and you can tick as many as you like. A conglomerate operating in financial services, healthcare and energy is a normal case, not an edge case.
One caution on the working sheets¶
Assessment and Evidence are where you type. Because the b sheets rebuild when the scope changes, rows move — and anything already typed stays put, which would line it up against a different row. Settle your scope first, then start recording. The sheets say so at the top.
Why a tile map and not a real one¶
Excel's Filled Map chart exists — Excel 2019 and later, plus the web and Mac versions — but it is unusable here for three reasons. It cannot be written by openpyxl at all, because map charts live in a separate chartEx part of the file format. It calls Bing to render, which fails on exactly the locked-down corporate machines where GRC work happens. And it does not exist in Excel 2016 or in LibreOffice.
A tile grid needs none of that, and for this data it reads better anyway. The SCF carries obligations for Bermuda, Qatar, Hong Kong and Singapore — specks on a real projection, but equal tiles give them equal weight, which is exactly right when what you are showing is does this jurisdiction bind me.
Install and run¶
pip install openpyxl
python scf_ui_builder.py "Secure Controls Framework (SCF) - 2026.2.xlsx"
That is the whole thing. One dependency, one command, nothing to download beyond the SCF itself — which is free and should come from the source: securecontrolsframework.com/free-content/scf-download ↗
The workbook and the coverage map are written beside it. No network access at any point, at build time or after. Rerun the same command against each new SCF release; the builder reads the version out of the sheet name, and hard-fails if any focal document has no matching column — a silent mismatch would produce a scope that looks right and is not.
MCR and DSR, and why the split matters¶
MCR — Minimum Compliance Requirements. Obligations imposed on you: statutory, regulatory or contractual. You do not get to opt out.
DSR — Discretionary Security Requirements. Things you adopted because they are good practice. ISO, NIST, CIS. You own the decision and you can decide differently.
The distinction changes who signs off on an exception. A gap against a DSR is a backlog item you can prioritise. A gap against an MCR is a finding. Sorting your in-scope controls by MCR count is the fastest way to find what genuinely cannot slip — and it is the view the tool is built around.
How the scoping rule works¶
A focal document is auto-selected when any of these hold:
- It is binding, its jurisdiction is yours (or EU-wide, with EU law switched on), and its sector is one of yours — or it is cross-sector, or data protection law. Those last two come through regardless, because they apply to essentially every organisation operating there. Data protection law does not care what business you are in.
- It is binding but not tied to a jurisdiction — PCI DSS, SWIFT CSCF, TISAX — and its sector is one you selected. Gated strictly on sector: you acquire these by doing a kind of business, not by being located somewhere.
- It is voluntary, you elected to adopt international standards, and its sector is one of yours or is cross-sector.
Then your ADD and DROP overrides apply.
What is derived, and therefore arguable¶
Check these before you rely on them
The SCF publishes a Geography column with five values: General, US, EMEA, APAC, Americas. It does not publish country, US state, sector, or a mandatory-versus-voluntary split. All four are derived by this tool — country from the focal document identifier, US state from the column header, sector from keyword rules plus a hand-written override table, and MCR/DSR from geography plus a list of general-geography regimes that are contractually binding.
These are judgement calls. They are written into the Scope sheet as editable values, and the engine reads the sheet rather than the code, so your corrections stick.
The most opinionated call: PCI DSS is classified MCR. It is contractual, not statutory. You cannot decline it and keep processing cards, so it behaves like an obligation — but if your counsel prefers otherwise, change the cell.
Verification¶
The scope is computed independently in Python from the source SCF file, then the generated workbook is recalculated headlessly in LibreOffice and the two compared. Eleven assertions cover focal-document counts, controls in scope, the MCR and DSR splits, the dashboard's independent recount, the control-detail driver table, and the evidence and assessment sheets. A second suite repeats the comparison across four unrelated country and sector profiles, so a tool that only worked for the profile it shipped with would fail. A third pass asserts row-level consistency across all 1,534 rows.
Tested in LibreOffice Calc 26.2. The formula vocabulary is deliberately Excel 2016-safe — SUMPRODUCT, INDEX, MATCH, COUNTIFS and nothing newer — but I have not run it in Excel, and I would rather say so than imply a test I did not perform. A PowerShell script is included for anyone who wants to confirm it there.
One defect found in the SCF source¶
emea-isr-cmo-2-0 is named "Ireland — Cybersecurity Methodology for an Organization", but its identifier (isr) and its column header (EMEA / Israel / CDMO 2.0) both say Israel. CDMO is the Israel National Cyber Directorate's methodology, so the name is wrong. The tool trusts the identifier, classifies it as Israel, and flags the discrepancy in the notes column.
Licensing¶
The SCF is published under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. Section 2(a)(1) grants the right to "produce and reproduce, but not Share, Adapted Material", and Section 3(b) removes any doubt: "You do not have permission under this Public License to Share Adapted Material."
A workbook built from SCF content is Adapted Material. So:
- Running the builder and using the result inside your own organisation is explicitly permitted.
- Publishing that workbook, hosting it for download, or handing it to a client as a deliverable is not — that needs a commercial licence from the Council.
Which is exactly why this page offers you a script and not a spreadsheet. The transformation runs on your machine, against your own copy. If you want to distribute the output, talk to the Council first.
The builder scripts are MIT licensed. They contain no SCF content.
The Secure Controls Framework is the work of the Secure Controls Framework Council, LLC, reproduced by this tool unchanged and used under CC BY-ND 4.0. The Council has not reviewed or endorsed this tool. Scoping is a legal determination as much as a technical one — this is a derivation aid, not legal advice. Confirm against the primary sources before you rely on anything.