FAQ
Common questions and answers about using the SCF Controls Platform.
General Questions
Section titled “General Questions”What is the SCF Controls Catalog?
Section titled “What is the SCF Controls Catalog?”The SCF (Secure Controls Framework) Controls Catalog contains:
- 1,451 security control definitions
- Evidence requirements for each control
- Mappings to 260+ compliance frameworks (ISO 27001, SOC 2, PCI DSS, HIPAA, NIS2, NIST 800-53, FedRAMP, and more)
The catalog is included in the platform and provides the foundational control library that the platform uses.
How often is the control catalog updated?
Section titled “How often is the control catalog updated?”On the managed SaaS, catalogue updates are applied by the platform team — no action required.
Self-hosted, the catalogue is yours: you download the SCF workbook and import it, because SCF content is licensed and cannot be redistributed with the software. Updating means importing a newer workbook and reconciling the differences — see Catalog Updates.
You can check the current catalog version under Settings, in the Catalog Version card.
What frameworks are supported?
Section titled “What frameworks are supported?”The platform supports 260+ compliance frameworks through control mappings. See Framework Management for the complete list including ISO 27001, SOC 2, PCI DSS, HIPAA, NIS2, NIST 800-53, FedRAMP, CMMC, and more.
User Access
Section titled “User Access”Does my role actually restrict what I can do?
Section titled “Does my role actually restrict what I can do?”Yes. Role-based access control is enforced on organisation-scoped endpoints: each declares the minimum role it requires, and a request from somebody below that is refused with a 403.
Admin outranks Editor, which outranks Viewer, so meeting a minimum means holding that role or a higher one. Managing users, member types and teams is Admin-only; editing controls, evidence and assignments is available to Editors and above; Viewers can read.
Enforcement is in the API rather than in the screen, so it applies to the web client, the MCP integration and direct API calls alike.
How do I add new users?
Section titled “How do I add new users?”By invitation. An admin opens Settings › User Management, clicks Invite User, enters the email address and picks a role and employment type. There is no self-registration — somebody has to be invited. How the invitee then joins depends on the deployment: on the bundled Keycloak they join the moment they first sign in; everywhere else they join by opening the invitation link and signing in.
What the invite does to their sign-in account depends on how the platform is deployed:
| Deployment | What the invite does |
|---|---|
Bundled Keycloak (--profile idp) | Creates their Keycloak account as well, with a temporary password shown once in the invite modal and sent in the invitation email. Keycloak makes them set a new password at first sign-in, and that first sign-in accepts the invitation — they land in the organisation without needing the link |
| Bring your own OIDC (Okta, Entra ID, Auth0, and so on) | Creates the platform-side invitation only. Create the account in your own identity provider too |
| Google Sign-In | Creates the platform-side invitation only. The person signs in with their own Google account |
Each pending invitation carries a badge — IdP account, No IdP account or External IdP — saying which of those happened. If no role is chosen the new member gets Viewer, and admins can change roles from the User Management page afterwards.
What happens to ownership when someone leaves?
Section titled “What happens to ownership when someone leaves?”Remove them from the organisation as normal, from the User Management page. All of their team memberships are removed automatically at the same time — every team, no exceptions, enforced by the database rather than by a cleanup step somebody has to remember.
The teams themselves endure, which is the whole point of having them. The team keeps its name, its function, its remaining members and its history, so the record of who owned what does not evaporate when a person does. If the leaver was a team’s primary, that team now shows a warning badge until you name a successor.
See Teams for how teams are set up.
Do teams change permissions?
Section titled “Do teams change permissions?”No. Teams are an ownership label, nothing more. Access control stays entirely on your organisation role — Admin, Editor or Viewer. There is no “team admin”, and joining a team never gives you access you did not already have.
Managing teams and their membership is an Admin task; viewing teams is available to any member of the organisation.
Does marking someone an external contractor restrict what they can do?
Section titled “Does marking someone an external contractor restrict what they can do?”No. Member type is a label for reporting and for making contractor involvement visible during an audit. It grants nothing and revokes nothing.
A contractor with the Admin role is a full admin. Marking them a contractor does not take anything away, and marking them internal again does not hand anything over. If you need to limit what somebody can do, change their role — Admin, Editor or Viewer — because that is the only thing that decides it.
See Internal Members and External Contractors.
The same person is staff at one organisation and a contractor at another. How does that work?
Section titled “The same person is staff at one organisation and a contractor at another. How does that work?”Exactly as you would expect, because the type belongs to the membership, not to the person. A consultant is internal at their own firm and an external contractor at every client they serve, and each organisation records its own relationship independently.
No organisation can see how another has classified the same person, and there is no global answer to look up. Yours is the only record that applies to your data, and marking somebody a contractor here has no effect anywhere else on the platform.
What is the difference between “Owner Team Label” and owning teams?
Section titled “What is the difference between “Owner Team Label” and owning teams?”They are two unrelated fields on a control that happen to use the same word.
Owner Team Label, on the Details tab, is free text — a label picked from a list your organisation maintains in Settings. It stores a name and nothing else. Nothing in it resolves to real people, and typing a name there does not create a team. It was called Owner Team before; only the name changed, and your existing values are untouched.
Owning teams, on the Assignments tab, points the control at real teams from User Management — with members, a named primary, a delegate and one or more business functions.
Both still work and neither corrects the other. Owning teams are the source of truth for who owns what; treat the label as a note.
Evidence items have owning teams but no free-text label, so the question does not arise there.
Can more than one team own a control?
Section titled “Can more than one team own a control?”Yes, and usually more than one should. Real compliance work is shared — one team builds the control, another monitors it, another evidences it — and a register that records only one of them is a fiction.
What you cannot have is more than one accountable team. Exactly one of the owning teams carries that marker, and marking a second one moves it rather than adding it.
Why does only one team get to be accountable?
Section titled “Why does only one team get to be accountable?”Because “everyone owns it” is how nothing gets owned. Shared ownership with nobody answerable is a standard audit finding: every team assumes another team had it, and the gap surfaces during the audit rather than before it.
Assign as many owning teams as reflect reality, then name the single team that answers when the control fails. A control or evidence item with teams assigned but none accountable shows a warning until you do — allowed, because deciding accountability is a separate act from assigning the work, but worth clearing before an audit.
Why isn’t a user appearing in the user list?
Section titled “Why isn’t a user appearing in the user list?”Users must sign in at least once to appear in User Management. If they’ve signed in but don’t appear:
- Check browser console for authentication errors
- Have the user sign out and sign in again
- Confirm the user signed in to the correct organisation
Data Management
Section titled “Data Management”Where is my data stored?
Section titled “Where is my data stored?”It depends how the platform was deployed.
Managed SaaS — in the cloud as part of the service, which handles automatic backups, encryption at rest and in transit, and high availability.
Self-hosted — entirely on your own infrastructure: PostgreSQL for the records, and object storage for evidence files — an S3-compatible store of your own (recommended), or the bundled MinIO container, which is what a fresh install falls back to and is intended for evaluation rather than real evidence. None of the SaaS guarantees above come with the self-hosted path: encryption at rest, high availability and retention are whatever you configure on the stores you chose, and nobody else backs any of it up. See Backup & Restore and Evidence Storage Settings.
How do I back up my data?
Section titled “How do I back up my data?”Managed SaaS — the platform team backs the service up. Use the tenant export if you want your own copy of an organisation’s working data.
Self-hosted — run scripts/backup.sh. It captures the whole database, the evidence volume and
your credentials together, and scripts/upgrade.sh takes the same set before every upgrade.
Backup & Restore covers what it does and does not reach — an
external database or external object storage needs its own protection.
Will I lose data if there’s an outage?
Section titled “Will I lose data if there’s an outage?”Managed SaaS — no. The service keeps automatic backups on redundant infrastructure.
Self-hosted — that depends entirely on the backups you take. Nothing in the platform protects
you from a failed disk, and the in-app export will not bring an installation back. Schedule
scripts/backup.sh, keep the output off the machine that runs the stack, and restore-test it before
you need it.
Sync and Refresh
Section titled “Sync and Refresh”How often does data sync?
Section titled “How often does data sync?”Every 20 seconds the platform asks the server whether anything has changed. It does not reload your data — that stays your decision. The header shows:
- “Updated 3m ago” — how long ago you last refreshed
- “Updates available”, with a dot — the poll found a change; click refresh or press R
Does sync pause when I’m editing?
Section titled “Does sync pause when I’m editing?”There is nothing to pause. The platform never replaces what is on your screen on a timer, so a half-finished form is never overwritten by someone else’s change. You will see the “Updates available” dot appear, and you refresh when you are ready.
Changes I made aren’t appearing. What do I do?
Section titled “Changes I made aren’t appearing. What do I do?”- Click Refresh in the header
- If changes still don’t appear, hard refresh your browser (Ctrl+Shift+R or Cmd+Shift+R)
- Check the browser console for errors
- Contact support if the issue persists
Evidence Collection
Section titled “Evidence Collection”What’s the difference between evidence status options?
Section titled “What’s the difference between evidence status options?”| Status | Meaning |
|---|---|
| Not Started | No evidence collected yet |
| In Progress | Collection underway |
| Collected | Evidence gathered but not verified |
| Verified | Evidence reviewed and confirmed valid |
| Expired | Evidence past its validity period |
| Not Applicable | This evidence doesn’t apply to your environment |
How do I link evidence to a system?
Section titled “How do I link evidence to a system?”- Go to the Evidence Workspace
- Select an evidence item
- In the detail panel, find Linked System
- Select from registered systems in the dropdown
Systems must be registered in the Systems Registry first.
Can I track evidence from third-party vendors?
Section titled “Can I track evidence from third-party vendors?”Yes — use Vendor Inventory, not the Systems Registry. The Systems Registry describes the tools that collect evidence (a cloud provider, an identity provider, a ticketing system), and its type list has no “Service Provider” entry; third parties are a first-class concept of their own.
Create the vendor in Vendor Inventory, then use vendor risk assessment to capture their evidence, approval decisions and annual reviews — see the dedicated Vendor Management and Vendor Risk Assessment guides.
Technical Issues
Section titled “Technical Issues”The page shows a blank screen
Section titled “The page shows a blank screen”Check browser console (F12 → Console) for errors. Common solutions:
- Hard refresh — Press Ctrl+Shift+R (Windows) or Cmd+Shift+R (Mac)
- Clear cache — Clear browser cache and cookies for this site
- Try incognito — Test in a private browsing window
- Try another browser — Rule out browser-specific issues
Google Sign-In shows an error
Section titled “Google Sign-In shows an error”Check browser console for specific error:
| Error | Solution |
|---|---|
popup_closed_by_user | User closed popup — retry |
idpiframe_initialization_failed | Clear cookies, disable ad blocker |
| Origin not allowed | Contact support |
See Authentication for more details.
Changes aren’t saving
Section titled “Changes aren’t saving”- Check for error messages in the UI
- Verify your internet connection
- Try refreshing the page
- Contact support if the issue persists
Updates and Upgrades
Section titled “Updates and Upgrades”How do I update the platform?
Section titled “How do I update the platform?”Managed SaaS — updates are applied by the platform team; no action required.
Self-hosted — run ./scripts/upgrade.sh <tag>. It backs up both data stores, validates the
dump, rebuilds, migrates as an explicit one-shot, verifies what is actually running, and rolls back
atomically on failure. Halfway through it hands over to the target release’s own copy of the script,
so a release that adds a step to the upgrade gets that step applied on the upgrade that introduces
it. docker compose up -d on its own will refuse to migrate an existing database, by design — see
Upgrading.
Will updates affect my data?
Section titled “Will updates affect my data?”Schema changes are applied by migrations, which are tested before release and are why the upgrade
script takes a backup first. On a self-hosted install that backup is your safety net: keep it, and
./scripts/upgrade.sh --rollback <TS> will put you back.
How do I check what version I’m running?
Section titled “How do I check what version I’m running?”The platform version appears:
- In the footer of each page
- From the
/api/versionendpoint
Getting Help
Section titled “Getting Help”Where can I report bugs or request features?
Section titled “Where can I report bugs or request features?”Contact support at support@scfcontrolsplatform.com with:
- Steps to reproduce
- Expected vs actual behaviour
- Browser console errors (if any)
- Screenshots (if applicable)
Is there a community forum?
Section titled “Is there a community forum?”Not currently. For now, use the support email for questions and feature requests.
Related Guides
Section titled “Related Guides”- Troubleshooting — Detailed troubleshooting steps
- Configuration — Platform settings
- Getting Started — Introduction to the platform