SCOR Overview
The NIST Security and Privacy Control Overlay Repository (SCOR) provides stakeholders a platform for voluntarily sharing control overlays created by subject matter experts to help reduce the duplication of effort and share best practices for the information security and privacy community.
What is a Control Overlay?
An overlay may provide a fully specified set of controls, control enhancements, and parameter values to address specific circumstances, situations, and/or conditions unique to specific communities of interest, industry sectors, or coalitions/partnerships.
Learn More About Overlays
Control Overlay Repository
How to Submit an Overlay
Why Develop Control Overlays?
Overlays are developed to apply to multiple systems within a community of interest and provide:
- an opportunity for the community of interest to add, modify, or eliminate controls from a baseline
- control applicability and interpretations for specific technologies, environments of operation, types of systems, types of missions/operations, industry sectors, and statutory/regulatory requirements
- an opportunity to standardize organization-defined parameter values that address the unique operational requirements for the community of interest
Who Can Use Overlays?
Any stakeholder and community of interest. Categories of overlays that may be useful include, for example:
- Communities of interest, industry sectors, or coalitions/partnerships (e.g., systems engineers, software developers, mission/business owners, healthcare, financial, transportation, energy);
- Information technologies/computing paradigms (e.g., cloud/mobile, PKI, Smart Grid);
- Environments of operation (e.g., space, tactical, sea);
- Types of information systems and operating modes (e.g., industrial/process control systems, weapons systems, single-user systems, standalone systems, IoT devices, sensors);
- Types of missions/operations (e.g., counterterrorism, first responders, research, development, test, and evaluation); and
- Statutory/regulatory requirements (e.g., Foreign Intelligence Surveillance Act, Health Insurance Portability and Accountability Act, Privacy Act, FISMA).
