Static JSON API for the Secure Controls Framework (SCF) v2026.1.1.

• 1468 controls across 33 families
• 249 framework crosswalks
• 41 threats, 39 risks
• 5776 assessment objectives, 303 evidence requests
• 1305 compensating controls, 258 privacy principles
• All static JSON, no auth, CC BY-ND.

GET api/controls.json — All 1468 controls with full metadata and crosswalks.

GET api/controls/{ID}.json — Single control (e.g., GOV-01, CRY-05.3).

Example response (truncated):

{
  "control_id": "GOV-01",
  "title": "Security, Compliance & Resilience Program (SCRP)",
  "family": "GOV",
  "family_name": "Cybersecurity & Data Protection Governance",
  "description": "Mechanisms exist to facilitate the implementation of security, compliance and resilience governance controls.",
  "scf_question": "Does the organization facilitate the implementation of security, compliance and resilience governance controls?",
  "relative_weight": 10,
  "conformity_cadence": "Annual",
  "pptdf": "Process",
  "nist_csf_function": "Govern",
  "scrm_focus": {
    "strategic": true,
    "operational": true,
    "tactical": true
  },
  "risks": [
    "R-AC-1",
    "R-AC-2",
    "R-AC-3"
  ],
  "threats": [
    "NT-7",
    "MT-1",
    "MT-2"
  ],
  "profiles": [
    "SCRMS",
    "CORE AI Model Deployment",
    "CORE ESP Level 1 Foundational",
    "CORE ESP Level 2 Critical Infrastructure",
    "CORE ESP Level 3 Advanced Threats",
    "CORE Mergers, Acquisitions & Divestitures (MA&D)"
  ],
  "crosswalks": {
    "general-aicpa-pmf-2020": [
      "M1.2-POF6"
    ],
    "general-aicpa-tsc-2017": [
      "CC1.1",
      "CC1.1-POF1",
      "CC1.2",
      "CC2.3-POF5"
    ]
  }
}

Each control includes: ID, title, family, description, assessment question, weight (0-10), conformity cadence, PPTDF applicability, NIST CSF function, SCRM focus tiers, SCR-CMM maturity levels (0-5), SCF profiles, possible solutions by org size, risk IDs, threat IDs, evidence request refs, and crosswalk mappings to all 249 frameworks.

GET api/families.json — All 33 families with control counts.

GET api/families/{CODE}.json — Family detail with all controls. Codes: AAT, AST, BCD, CAP, CFG, CHG, CLD, CPL, CRY, DCH, EMB, END, GOV, HRS, IAC, IAO, IRO, MDM, MNT, MON, NET, OPS, PES, PRI, PRM, RSK, SAT, SEA, TDA, THR, TPM, VPM, WEB

GET api/crosswalks.json — Index of all 249 frameworks with coverage stats.

GET api/crosswalks/{FRAMEWORK_ID}.json — Bidirectional crosswalk (truncated):

{
  "framework_id": "general-nist-800-53-r5-2",
  "display_name": "NIST SP 800-53 R5",
  "scf_to_framework": {
    "total_mappings": 777,
    "mappings": {
      "GOV-01": [
        "PM-01"
      ],
      "GOV-02": [
        "AC-01",
        "AT-01",
        "AU-01",
        "CA-01",
        "CM-01",
        "CP-01",
        "IA-01",
        "IR-01",
        "MA-01",
        "MP-01",
        "PE-01",
        "PL-01",
        "PM-01",
        "PS-01",
        "PT-01",
        "RA-01",
        "SA-01",
        "SC-01",
        "SI-01",
        "SR-01"
      ]
    }
  },
  "framework_to_scf": {
    "total_mappings": 810,
    "mappings": {
      "PM-01": [
        "GOV-01",
        "GOV-02",
        "GOV-03"
      ],
      "AC-01": [
        "GOV-02",
        "GOV-03",
        "IAC-01"
      ]
    }
  }
}

GET api/threats.json — All 41 threats (natural + man-made).

GET api/threats/{ID}.json — Single threat (e.g., NT-1, MT-1). Fields: threat_id, grouping, name, description.

GET api/risks.json — All 39 risks with NIST CSF function mapping.

GET api/risks/{ID}.json — Single risk (e.g., R-AC-1). Fields: risk_id, grouping, name, description, nist_csf_function.

GET api/assessment-objectives.json — All 5776 assessment objectives.

GET api/assessment-objectives/{SCF_ID}.json — AOs for a specific control. Fields: ao_id, objective, pptdf, origin, assessment_rigor, scf/org defined parameters.

GET api/evidence-requests.json — All 303 evidence request items.

GET api/evidence-requests/{ERL_ID}.json — Single item (e.g., E-GOV-01). Fields: erl_id, area, artifact_name, artifact_description, scf_controls, cmmc_mapping.

GET api/compensating-controls.json — All 1305 compensating control entries.

GET api/compensating-controls/{SCF_ID}.json — Compensating controls for a specific control. Includes risk if not implemented and up to 2 compensating controls with justification.

GET api/privacy-principles.json — All 258 SCF data privacy management principles with crosswalks to 32 privacy frameworks.

GET api/summary.json — Version, counts for all resource types, weight distribution.

GET api/controls/GOV-01.json → control metadata, risks, threats, crosswalks
GET api/assessment-objectives/GOV-01.json → assessment objectives
GET api/compensating-controls/GOV-01.json → compensating controls if primary fails

GET api/crosswalks/general-nist-800-53-r5-2.json → .framework_to_scf.mappings["PM-01"]

GET api/risks/R-AC-1.json → risk details
GET api/controls.json → filter controls where .risks includes "R-AC-1"

GET api/controls/GOV-01.json → .evidence_requests → ["E-GOV-01", "E-GOV-02"]
GET api/evidence-requests/E-GOV-01.json → artifact details

GET api/crosswalks.json → compare scf_controls_mapped across frameworks

• Versioning: SCF v2026.1.1. Check api/summary.json.
• Licensing: CC BY-ND. Share and use freely, but no derivative works of the framework itself.
• Missing mappings: No crosswalk entry = no established mapping, not irrelevance.
• Framework IDs: Source-derived from the SCF workbook. Use exact IDs from api/crosswalks.json.
• Static data: No server-side filtering. Download and filter client-side.
• 404s: Invalid IDs return GitHub Pages' default 404.