The Complete Catalog
The entire framework compiled into one document. All twelve domains, 56 families, and 1,176 controls in a single reference.
SHA-256
10d68370…eaebd7
One coherent control catalog for the whole enterprise, written from principle instead of assembled from vendors.
Executive governance through physical facilities, artificial intelligence through post-quantum readiness. Every requirement states an outcome to achieve, never a product to buy.
SCOPE is a comprehensive, vendor-neutral catalog of cybersecurity controls for private-sector organizations. It organizes the full span of enterprise security, from executive governance to physical facilities and emerging disciplines such as artificial intelligence and post-quantum readiness, into one structured body of requirements an organization can adopt, tailor, and measure against.
It is authored from principle rather than derived from any single product, vendor, or environment. Every requirement is expressed in terms of what an organization must achieve, not which tool it must buy.
Most organizations assemble their security requirements from several overlapping frameworks, each written for a different audience and updated on a different cycle. The result is duplication, gaps between domains, and controls that are hard to trace to a business outcome.
SCOPE provides one coherent, plainly written control set that spans the enterprise, uses a consistent structure and identifier scheme in every domain, and ties each control to an operational objective. It works on its own, or as a unifying layer above the frameworks an organization already reports against.
SCOPE is built in three layers. A Domain is a major area of enterprise security, such as Identity and Access Management or Threat Management and Security Operations. Within each domain, a Control Family groups related requirements under a short letter code, such as PAM for Privileged Access Management. Within each family, a Control is a single, testable requirement written as a normative statement.
Every control is phrased as an outcome the organization shall achieve. That keeps the catalog implementation neutral and auditable, and it keeps SCOPE durable as tools change. An organization can satisfy a control with whatever implementation fits its environment, provided the stated outcome is met.
Every control carries an identifier in the form FAM-NN, where FAM is the two to five letter family code and NN is the control number within that family. Identifiers are stable references. They are the durable way to cite a SCOPE requirement in policies, audits, and mappings.
Adopt the catalog in full, or select the domains and families that match your risk profile. A twelve person company and a global manufacturer do not need the same span.
Control text is written to be edited. Adjust wording to your context and systems, and keep the stated outcome intact so the requirement stays testable.
SCOPE parallels the domain and control model common to recognized catalogs, so cross-mapping is direct. Trace SCOPE identifiers to the frameworks you already report against.
SCOPE is published under the Creative Commons Attribution 4.0 International license. You are free to copy, redistribute, adapt, and build on it, including for commercial purposes, provided you credit the author. Derivative works should cite the SCOPE controls they draw from by their identifiers, so lineage stays clear for anyone auditing the result.
SCOPE is designed to complement, not replace, the frameworks already in place. A formal crosswalk to major frameworks is planned as a companion resource, so a single SCOPE control can be traced to its equivalents elsewhere.
Version 1.0, eighteen files. Every SCOPE document is free to download. No email, no form, no gate.
The entire framework compiled into one document. All twelve domains, 56 families, and 1,176 controls in a single reference.
The full catalog as a working spreadsheet, with maturity scoring on a five rung ladder and framework crosswalks. Open it and start rating.
SCOPE version 1.0, released 2026-07-22. The framework is published under CC BY 4.0: free to copy, adapt, and build on with attribution, including commercially. The assessment workbook adds Apache 2.0 for its tooling, with the SCOPE prose inside it still under CC BY 4.0.
SCOPE is a trademark of Tim D. Tipton Jr.
Everything above is already yours, no signup required. If you are adopting SCOPE and want to know when a version ships or a crosswalk lands, leave an address and I will tell you. Nothing else.