CORF Workbook

An independent, open tool for assessing against the Central Bank of Kuwait Cyber and Operational Resilience Framework (CORF), version 1.0.

The CORF is CBK's resilience first successor to the 2020 Cybersecurity Framework, issued in December 2025 and mandatory for every entity CBK regulates. Its requirements live in three control baselines totalling 876 controls, assessed on two layers: control level compliance and sub domain maturity, rolled up to an overall posture.

This repository provides a self contained, offline assessment workbook that does that assessment for you, plus the control catalog as open data and the extractor that produced it.

Live: https://siteq8.github.io/CORF/  ·  Open the workbook: https://siteq8.github.io/CORF/workbook.html

---

What is in here

File	What it is
docs/workbook.html	The assessment workbook. A single HTML file, no dependencies, runs offline. Open it in any modern browser.
docs/index.html	The explainer and how to use guide (the project landing page).
docs/corf-catalog.json	The full CORF control catalog as structured JSON: three baselines, domains, sub domains, control areas, and controls.
extract_catalog.py	The script that extracts the catalog from the published CORF PDF, for reproducibility.

The workbook

Everything runs in your browser. There is no server, no account, and no telemetry. Nothing you enter is ever transmitted anywhere, so a regulatory self assessment stays entirely on your machine. Work through five steps:

1. Applicability - declare each domain and sub domain Applicable or Not applicable, with a justification where it does not apply. This mirrors the CORF Statement of Applicability. Not applicable items drop out of every score.
2. Assess - for each control, choose Compliant, Non compliant, or Not applicable, and record the supporting evidence.
3. Maturity - set a level from one to five for each sub domain. The workbook enforces the CORF rule: you cannot select Baseline (level 3) or higher until every applicable control in the sub domain is compliant.
4. Dashboard - read the roll up: overall compliance and maturity, a compliance bar for every domain, and a maturity radar for each baseline.
5. Gaps - every control marked Non compliant becomes a tracked gap with a priority, owner, target date, and status. Export the remediation plan as CSV.
6. Data - export your assessment to JSON to back it up or hand it to a colleague, import it back, or print a clean report.

How the scoring works

The workbook computes scores the way the CORF describes:

• Compliance. A sub domain's compliance is the share of its applicable controls marked compliant, with Not applicable controls left out. Domain compliance is the average across its sub domains, and the overall score is the average across domains.
• Maturity. You set a level per sub domain on a five level scale (1 Initial, 2 Ad hoc, 3 Baseline, 4 Advanced, 5 Innovative). Domain maturity is the average of its sub domains, and overall maturity is the average across domains. The scale is progressive: Baseline or higher requires full compliance in that sub domain.

The control catalog

docs/corf-catalog.json holds the three baselines with their full hierarchy and control text:

Baseline	Code	Domains	Sub domains	Controls (extracted / official)
Cyber Resilience Baselines	CRB	6	33	516 / 519
Operational Resilience Baselines	ORB	8	17	148 / 146
Third Party Risk Management Baselines	TPRM	13	43	210 / 211
Total		27	93	874 / 876

Each control carries a globally unique key of the form CODE:id (for example CRB:4.1.1.1), since the numeric ids repeat across baselines.

The catalog is extracted programmatically from the published CORF v1.0 document. 874 of the 876 controls are captured and the sub domain counts match the framework exactly. A small residual difference remains in two baselines and should be reconciled against the source before formal use. Regenerate with:

pip install pdfplumber
python3 extract_catalog.py

Running it

No build step. Either visit the live site above, or clone the repository and open docs/workbook.html directly in a browser. It works from file:// and offline.

Disclaimer

This is an independent, open source aid. It is not affiliated with, endorsed by, or produced by the Central Bank of Kuwait. It is not the official CORF toolkit and not a substitute for a CBK approved assessor. It encodes the assessment methodology described in the framework to help entities prepare. Always refer to the official CORF documents for authoritative requirements, and validate the extracted catalog against the source.

License

MIT. See LICENSE.