How is the Secure Controls Framework organized, and roughly how large is its control catalog?

The SCF organizes "cybersecurity and data privacy by design" into 33 domains containing over 1,300 controls (~1,450 in total across versions).

The catalog (e.g. version 2023.4) is structured as 33 domains built around "Cybersecurity & Data Privacy by Design" principles, holding over 1,300 controls. Domains span everything from access control and asset management to vulnerability management and third-party risk. The scale is the point: it is comprehensive enough that an organization can pick the relevant subset rather than reconcile many overlapping standards by hand.

Go deeper:

• Secure Controls Framework — offizielle Website — Bestätigt 33 Domänen mit über 1.400 Controls; Download in CSV und OSCAL JSON.