SCF Controls Platform — open source

What it is

SCF Controls Platform is self-hosted GRC software for the Secure Controls Framework (SCF), released under AGPL-3.0. It is built and maintained by one practising GRC consultant who runs client engagements on it, with community contributions on GitHub. It is not affiliated with or endorsed by ComplianceForge, which publishes the SCF.

Preconditions / Affected

The licence split matters most for adoption. AGPL-3.0 covers the platform code only. The SCF content is published by ComplianceForge under its own licensing, and the platform authors say they cannot relicense or adapt it. The platform is built to run the free version of the SCF content out of the box. A team that wants to modify the SCF controls needs a licence from ComplianceForge.

Costs are infrastructure only. The page states there are no seat licences, tiers or per-framework fees.

What to do

• Install with Docker Compose. The page says the docs cover this in under an hour.
• Use the Helm chart for Kubernetes.
• Scope a framework in the platform. A matrix then shows which SCF controls serve it. Named examples are SOC 2, ISO 27001, ISO 27017, NIST CSF, NIST 800-53, PCI DSS, GDPR, Cyber Essentials and HIPAA.
• Consultants can run per-client workspaces on a shared control library.
• If you plan to fork the code and also modify SCF content, read the SCF licensing page first.

Caveats

• The page positions the tool against Vanta and Drata as open source, self-hosted and SCF-native, with no vendor lock-in. It describes those products as hosted subscription services with their own control sets and large integration libraries. The page does not list any integrations of its own, so automated evidence collection is not established.
• The page gives no version numbers, release dates, or security or hardening guidance for the self-hosted deployment.
• A single maintainer is named as the builder, so project continuity is something to check on GitHub.
• The "354+" mapping count is stated "at the time of writing" and may change.