The Secure Controls Framework (SCF) Council has published SCF 2026.3, and it is now live in SCF Connect. This is not a routine refresh. It renumbers most control IDs, adds a new domain, and changes how assessment objectives are scoped. If your organization references SCF control IDs anywhere outside SCF Connect, such as spreadsheets, policies, or audit findings, this update affects you.

Nothing changes for your organization automatically. You review the update and choose when to accept it.

What’s new in SCF 2026.3

Control IDs are renumbered. Most controls keep their underlying requirement but get a new ID. A small number keep the exact ID they have today. A larger set of old IDs are reused for a completely different requirement. For example, GOV-01 is now a brand-new governance policy control, and the control you knew as GOV-01 now lives at GOV-02. SCF Connect maps every one of your existing controls to its new location and shows you the mapping before you accept anything.

A new domain: Quantum Security (QTS). SCF 2026.3 adds 31 controls covering security practices for the era of quantum computing, organized under a dedicated Quantum Security domain.

Two domains are renamed. The domain formerly known for cybersecurity and data protection governance is now “Security, Compliance & Resilience Governance.” The domain covering artificial intelligence is now “Artificial Intelligence & Autonomous Technologies,” reflecting the broader scope of autonomous systems the domain now addresses.

More controls overall. The 2026.3 catalog contains 1,591 controls across 34 domains, along with new and reworded assessment objectives, additional evidence requests, and new framework editions mapped into the SCF.

New assessment rigor levels. SCF 2026.3 introduces three levels of assessment rigor: Standard, Enhanced, and Comprehensive. Each level builds on the one before it. Standard is the default and is right for most organizations; it checks that each control is in place and free of obvious errors. Enhanced and Comprehensive add progressively more detailed objectives for organizations that want deeper assurance. Not every organization is offered a choice: some frameworks already specify a fixed set of objectives, or are assessed at the Standard level only.

How the update works for your organization

Nothing changes until a Manager or Practitioner in your organization reviews and accepts the update. Administrators, Assessors, and Vendors cannot start, accept, or undo it, though Assessors will see the effects on the controls they assess once it is accepted.

When the update is available for your organization, a notice appears at the top of your screen. Selecting Review Changes takes you to a read-only summary: the controls in scope today and after the update, which answers carry over automatically, which answers need a second look, and (if applicable) which controls were merged and which new objectives you will need to answer.

Most of your existing answers carry over automatically. Where an assessment objective’s wording changed, or two controls were merged into one, your answer is kept but flagged so you can re-confirm it against the new wording on a dedicated review list after the update. A small number of answers no longer have a matching objective in 2026.3; the update keeps a copy of each one, and they return if you undo.

If your organization is asked to choose a rigor level, you can change your selection as many times as you like while still on the review page. Once you are ready, the Accept page shows the figures again, asks you to confirm you understand that control numbers will change, and starts the update. It runs for a few minutes and finishes with a link to your post-update review list.

Open assessments are kept, along with their answers and evidence, but their control numbers change to match 2026.3. If you have assessments in progress, let everyone working in them, including your Assessor, know before you accept the update.

You can undo it

You can undo the update to SCF 2026.3 for 30 days after it is applied. Undoing puts your organization back on the edition it used before, SCF 2025.3.1 in SCF Connect, exactly as it was before you accepted, and removes any work done on the new numbering since. Evidence in your library is never deleted; only its links to removed rows are.

There is no deadline

You can review the update today and accept it later, or leave the notice until you are ready. Each organization updates on its own schedule, and one organization’s choice does not affect any other.

A full walkthrough, including how the rigor level choice works and what the post-update review list covers, is available in SCF Connect’s help documentation.

Start your free trial to see how SCF Connect keeps your compliance program in sync with every SCF edition, including 2026.3.

Related resources: