Cybersecurity & Data Privacy by Design Principles (C|P)

The C|P establishes 33 common-sense principles to guide the development and oversight of a modern cybersecurity & data privacy program. The C|P is sourced from the Secure Controls Framework (SCF), which is a free
resource for businesses. The SCF?s comprehensive listing of over 1,000 cybersecurity & data privacy controls is categorized into 33 domains that are mapped to over 100 statutory, regulatory and contractual frameworks. Those
applicable SCF controls can operationalize the C|P principles to help an organization ensure that secure practices are implemented by design and by default. Those 33 C|P principles are listed below:

1. Cybersecurity & Data Privacy Governance (GOV)

Execute a documented, risk-based program that supports business objectives
while encompassing appropriate cybersecurity & data privacy principles that
13. Embedded Technology (EMB)
Provide additional scrutiny to reduce the risks associated with embedded technology,
based on the potential damages posed from malicious use of the technology.
C|P 2023.3
addresses applicable statutory, regulatory and contractual obligations.

2. Artificial Intelligence and Autonomous Technology (AAT) 14. Endpoint Security (END)
Ensure trustworthy and resilient Artificial Intelligence (AI) and autonomous Harden endpoint devices to protect against reasonable threats to those devices and the
technologies to achieve a beneficial impact by informing, advising or simplifying data those devices store, transmit and process.
tasks, while minimizing emergent properties or unintended consequences.

3. Asset Management (AST) 15. Human Resources Security (HRS)

Manage all technology assets from purchase through disposition, both physical Execute sound hiring practices and ongoing personnel management to cultivate a
and virtual, to ensure secured use, regardless of the asset?s location. cybersecurity & data privacy-minded workforce.

25. Risk Management (RSK)

4. Business Continuity & Disaster Recovery (BCD) 16. Identification & Authentication (IAC) Proactively identify, assess, prioritize and remediate risk through alignment with
Maintain a resilient capability to sustain business-critical functions while Enforce the concept of ?least privilege? consistently across all systems, applications and industry-recognized risk management principles to ensure risk decisions adhere to
successfully responding to and recovering from incidents through services for individual, group and service accounts through a documented and the organization's risk threshold.
well-documented and exercised processes. standardized Identity and Access Management (IAM) capability.
26. Secure Engineering & Architecture (SEA)
5. Capacity & Performance Planning (CAP) 17. Incident Response (IRO) Utilize industry-recognized secure engineering and architecture principles to deliver
Govern the current and future capacities and performance of technology assets. Maintain a viable incident response capability that trains personnel on how to recognize secure and resilient systems, applications and services.
and report suspicious activities so that trained incident responders can take the appropriate
steps to handle incidents, in accordance with a documented Incident Response Plan (IRP).
6. Change Management (CHG) 27. Security Operations (OPS)
Manage change in a sustainable and ongoing manner that involves active 18. Information Assurance (IAO) Execute the delivery of cybersecurity & data privacy operations to provide quality
participation from both technology and business stakeholders to ensure that only Execute an impartial assessment process to validate the existence and functionality of services and secure systems, applications and services that meet the organization's
authorized changes occur. appropriate cybersecurity & data privacy controls, prior to a system, application or service business needs.
being used in a production environment.
7. Cloud Security (CLD) 28. Security Awareness & Training (SAT)
Govern cloud instances as an extension of on-premise technologies with equal or 19. Maintenance (MNT) Foster a cybersecurity & data privacy-minded workforce through ongoing user
greater security protections than the organization?s own internal cybersecurity & Proactively maintain technology assets, according to current vendor recommendations for education about evolving threats, compliance obligations and secure workplace
data privacy controls. configurations and updates, including those supported or hosted by third-parties. practices.

8. Compliance (CPL) 20. Mobile Device Management (MDM)

Oversee the execution of cybersecurity & data privacy controls to ensure Implement measures to restrict mobile device connectivity with critical infrastructure and 29. Technology Development & Acquisition (TDA)
appropriate evidence required due care and due diligence exists to meet sensitive/regulated data that limit the attack surface and potential data exposure from Develop and test systems, applications or services according to a Secure Software
compliance with applicable statutory, regulatory and contractual obligations. mobile device usage. Development Framework (SSDF) to reduce the potential impact of undetected or
unaddressed vulnerabilities and design weaknesses.
9. Configuration Management (CFG) 21. Network Security (NET)
Enforce secure configurations for systems, applications and services according to Architect and implement a secure and resilient defense-in-depth methodology that enforces 30. Third-Party Management (TPM)
vendor-recommended and industry-recognized secure practices. the concept of ?least functionality? through restricting network access to systems, Execute Supply Chain Risk Management (SCRM) practices so that only trustworthy
applications and services. third-parties are used for products and/or service delivery.

10. Continuous Monitoring (MON) 22. Physical & Environmental Security (PES)
Maintain situational awareness of security-related events through the centralized Protect physical environments through layers of physical security and environmental 31. Threat Management (THR)
collection and analysis of event logs from systems, applications and services. controls that work together to protect both physical and digital assets from theft and Proactively identify and assess technology-related threats, to both assets and
damage. business processes, to determine the applicable risk and necessary corrective action.

11. Cryptographic Protections (CRY) 23. Data Privacy (PRI)

Utilize appropriate cryptographic solutions and industry-recognized key Align data privacy practices with industry-recognized data privacy principles to implement 32. Vulnerability & Patch Management (VPM)
management practices to protect the confidentiality and integrity of appropriate administrative, technical and physical controls to protect regulated personal Leverage industry-recognized Attack Surface Management (ASM) practices to
sensitive/regulated data both at rest and in transit. data throughout the lifecycle of systems, applications and services. strengthen the security and resilience systems, applications and services against
evolving and sophisticated attack vectors.
12. Data Classification & Handling (DCH) 24. Project & Resource Management (PRM)
Enforce a standardized data classification methodology to objectively determine Operationalize a viable strategy to achieve cybersecurity & data privacy objectives that 33. Web Security (WEB)
the sensitivity and criticality of all data and technology assets so that proper establishes cybersecurity as a key stakeholder within project management practices to Ensure the security and resilience of Internet-facing technologies through secure
handling and disposal requirements can be followed. ensure the delivery of resilient and secure solutions. configuration management practices and monitoring for anomalous activity.

Copyright 2023 by Secure Controls Framework Council, LLC (SCF Council). All rights reserved.

All text, images, logos, trademarks and information contained in this document are the intellectual property of SCF Council, unless otherwise indicated. Modification of any content, including text and images, requires the prior written permission of SCF Council. Requests may be sent to [email protected].