Secure Control Framework

Exoscale leverages the Secure Control Framework as the core of our internal compliance program. Our controls are mapped to SCF domains, enabling us to maintain continuous compliance with multiple international standards—including ISO 27001, SOC 2, PCI DSS, HDS, GDPR, HIPAA, and more. The SCF supports our ability to respond to customer and regulatory requirements efficiently, providing a transparent, future-proof foundation for audits and security reviews.

The SCF has been developed by analyzing over 100 statutory, regulatory, and contractual frameworks, and its controls are directly mapped to many of the world’s leading standards, including: - ISO/IEC 27001 and 27002 - NIST SP 800-53 and NIST Cybersecurity Framework - SOC 2 (AICPA Trust Services Criteria) - CIS Critical Security Controls (CIS CSC) - PCI DSS - HIPAA / HITECH - GDPR, CCPA, and global privacy regulations - HDS (France), and many more

This means that compliance with Exoscale’s SCF-based controls directly supports evidence requirements for major certifications and audits.

No—SCF is not a certification, but a framework and set of best practices. Using the SCF enables organizations to meet the requirements of many certifications and regulatory frameworks efficiently, but the SCF itself does not provide a formal certificate or audit report.