sscf-benchmark

To benchmark SaaS security controls against the SSCF framework, you input an OSCAL backlog JSON file to automatically score compliance status and generate a domain-level heatmap showing coverage gaps across areas like identity, access management, and data security.

A domain-level heatmap for SaaS security compliance visually represents your control coverage across SSCF domains. It categorizes controls as covered, partial, or gap, providing a clear overview of which areas require immediate attention.

You generate a compliance heatmap from an OSCAL backlog JSON file by benchmarking it against an SSCF control index YAML. This process scores your SaaS security controls and outputs a visual representation of domain coverage status.

You do not strictly need to provide an SSCF control index YAML to assess SaaS compliance, as it is an optional input for scoring. However, providing it allows for customized status determination and more accurate benchmarking against the framework.

You can score Salesforce security assessments using the CSA SSCF by processing the assessment data as an OSCAL backlog JSON. This generates a heatmap showing which SSCF domains require the most attention for your Salesforce compliance.

SaaS security domains evaluated in an OSCAL SSCF benchmark include identity and access management, logging, and data security. The benchmark assesses these domains to identify compliance status and coverage gaps within your backlog.