What practical exercise demonstrates how the SCF is used to answer real security questions?

Working in small groups with the open SCF, learners find the controls that secure a given application, count how many laws/frameworks/regulations the SCF covers, and locate AI-specific controls — showing the SCF as a searchable, answer-generating catalog.

The hands-on task set: (1) find controls to secure an application, (2) determine how many laws, frameworks and regulations are covered within the SCF, and (3) find controls about AI and how many ISO standards include AI controls. The point of the exercise is that the SCF is not just reference reading — you query it to answer concrete "how do I secure X / what must I comply with" questions, which is exactly how it is used day-to-day.