Navigating the Regulatory Headwinds

!!! note TL;DR> Mapping controls is a data problem, check out my SCF Visualizer Tool if you want to see for yourself.

Is your GRC program suffering from 'regulatory lockout'? 🔒

Once upon a time, managing security requirements was so simple, all it took was a spreadsheet, maybe even only one tab… Actually, for many practitioners that is the status quo. The truth is, for many companies, spreadsheets work great. It's easy and spreadsheets are the second language for any security auditor and so it's what a lot of SecGov folks use today.

The problem with spreadsheets is that they often start small but end big. Case in point:

The Secure Controls Framework, a free security meta-framework that provides mappings for control requirements from over 300 international regulatory frameworks and standards. The full set clocks in at 1,451 control requirements to cover them all.

I like to think of this as The Mother of all Frameworks. It's an invaluable tool, but as you can see for yourself the secure-controls-framework-scf-2025-4.xlsx which is available under creative commons license on the @securecontrolsframework GitHub repo.

The SCF spreadsheet is an unwieldy beast reaching column "NO" in excel and coming in at 141,536 cells. The data is extremely valuable but in spreadsheets form it is largely opaque.

Can we do it better?

Lately, I've been having a lot of conversations about managing the security requirements and how complex this problem has become.

Maintaining a single framework is generally manageable but any company that wants to break into a new industry or jurisdiction will encounter additional compliance regimes with different requirements.

Unfortunately for companies trying to reach new markets, that means a lot of overlapping requirements that are difficult to assess. A growing company needs a small battalion of compliance employees, consultants, and third-party auditors to maintain the security narrative.

Companies failing an audit can incur large fines and lose access to their markets until the regulators are satisfied.

Growth is often impeded by these regulatory headwinds and, when the spreadsheet doesn't scale, we get regulatory lockout. Sadly GRC becomes the bottleneck.

As the SCF shows us, GRC is complicated to the point where it takes an entire institution to maintain a single 300 column spreadsheet. We need a better approach.

Data First

The SCF is a great example of why I see GRC as, primarily, a data problem. A good visualization can go a long way to relieving the cognitive burden of a giant spreadsheet and that's true for the SCF as well

To help illuminate the structure and cross regime mapping that SCF provides, I've put together this tool that uses data from the Secure Controls Foundation (SCF) to show how requirements from multiple regimes overlap (or not) and help get a sense of the shape or coverage of one's preferred frameworks.

All in one

First up here is the entire SCF in all its 1,451 control glory all in one place:

I've grouped the controls into distinct categories using data from the SCF sheet. The hierarchy is defined by the values from the SCF Domain, PPTDF Applicability and NIST CSF Function Grouping columns found in the SCF.

The circles are packed using the Relative Control Weighting column to provide some perspective. From this view we can start to explore and drill into the different groups of controls, and generally, see the structure of the SCF control hierarchy.

The Shape of a framework

No one (I hope) needs to implement all SCF controls. SCF is a meta-framework so let's use it to view an actual framework, using the SCF's hierarchy to provide common structure.

Here's what NIST-CSF 2.0 (my fav) looks like using the same hierarchy as the SCF:

What I like about circle packing charts is that we can see how the underlying data from the spreadsheet is shaped.

That structure, which you can't see in the spreadsheet, is meaningful. For instance, we can immediately see how the NIST-CSF is more targeted to process than technology

By contrast, The CIS-CSC controls lean more heavily on technology controls than the CSF:

Adding back the unmapped SCF controls we can see how sparse the mappings are when compared to the full universe of requirements:

The lesson here is that if you are only looking at CIS then you are missing out on a lot of the other control domains.

Let's mix and match

My visualizer tool allows any of the frameworks from the SCF to be used, so let's add some common ones that we can compare to each other: Here are the complete SCF Mappings for:

• GDPR
• ISO27001
• NIST-CSF

All combined controls requirements, for all the frameworks, in a single view, which is normalized by leveraging the SCF Mappings:

It's clear in the diagram that many of these control requirements do not overlap. This can tell us which controls might be missing when going from one regime to another.

The Devil in the Details

When we drill in we can see precisely which control requirements the regimes have in common and which control requirements are distinct for a given set of frameworks.

The SCF Visualizer

I created the visualizer free for anyone to use, so please feel free to leverage it and see the shape of your compliance controls.

Ready to escape the spreadsheet tyranny? Check out the SCF Visualizer and see the shape of your controls now!

It's deployed as a live site here or downloadable from my SCF Visualizer project on GitHub to make your own spin.

Hashtags: #GRC #Compliance #Cybersecurity #SecurityControls #NISTCSF.