How it works
Bring your own workbook.
Get the official SCF
Download the free Excel workbook from the Secure Controls Framework Council — the licensing stays theirs, the data stays yours.
Drop it in
A Web Worker parses every sheet in seconds and caches the model locally in IndexedDB. Nothing is uploaded — there's nowhere to upload it to.
Explore everything
Controls, crosswalks, maturity levels, risks, threats, assessment objectives, evidence — indexed, searchable, linked.
What's inside
Every angle of the framework.
Controls, in full detail
Each control gets a registry-style plate with its description, maturity criteria across all six levels, mapped risks and threats, and assessment objectives — one page, everything linked.
Crosswalk ~250 frameworks
See how any two frameworks relate through the SCF — which controls satisfy both, where the gaps are, and how coverage distributes across domains.
Program scopes & share links
Name a scope, pick your frameworks, and get live coverage math across the catalog. Share it with a link that carries framework IDs only — never your data.
Private by architecture
Your workbook never leaves your browser.
No backend
Static files on GitHub Pages. There is no server to send your data to.
No accounts
No sign-up, no login, no tracking pixels, no telemetry of any kind.
Local cache
Parsed once into IndexedDB — instant reloads, workbook stays on disk.
Works offline
Installable PWA. After first load, the whole app runs without a network.
Open source
MIT-licensed, built in the open.
The entire viewer — parser, indexes, UI — is free software. Read the code, file issues, send PRs. If it helps your compliance program, star it and tell a colleague.
SCF content belongs to the Secure Controls Framework Council (CC BY-ND 4.0). This app ships no SCF data — you bring the official workbook, and it's rendered verbatim.