+Článek 15 Přesnost, spolehlivost a kybernetická bezpečnost
---+Článek 15 1.
---+Článek 15 2.
---+Článek 15 3.
---+Článek 15 4.
---+Článek 15 5.

Článek 15 Přesnost, spolehlivost a kybernetická bezpečnost

-

1. Přehled

,
Článek 15 1.
Vysoce rizikové systémy AI jsou navrženy a vyvinuty tak, aby dosahovaly náležité úrovně přesnosti, spolehlivosti a kybernetické bezpečnosti a aby v tomto ohledu dosahovaly konzistentních výsledků během celého svého životního cyklu.
Článek 15 2.
S cílem řešit technické aspekty způsobů měření náležitých úrovní přesnosti a spolehlivosti stanovených v odstavci 1 a jakékoli další relevantní metriky výkonnosti Komise ve spolupráci s příslušnými zúčastněnými stranami a organizacemi, jako jsou metrologické a srovnávací orgány, případně podpoří vypracování referenčních hodnot a metodik měření.
Článek 15 3.
Úrovně přesnosti a příslušné metriky přesnosti vysoce rizikových systémů AI jsou oznámeny v přiloženém návodu k použití.
Článek 15 4.
Vysoce rizikové systémy AI musí být v nejvyšší možné míře odolné vůči chybám, poruchám nebo nesrovnalostem, které se mohou vyskytnout v daném systému nebo v prostředí, ve kterém tento systém funguje, zejména v důsledku jejich interakce s fyzickými osobami nebo jinými systémy. Za tímto účelem se přijmou technická a organizační opatření.

Spolehlivosti vysoce rizikových systémů AI lze dosáhnout pomocí technicky redundantních řešení, která mohou zahrnovat plány zálohování nebo zajištění proti selhání.

Vysoce rizikové systémy AI, které se po uvedení na trh nebo do provozu dále učí, jsou vyvíjeny tak, aby se vyloučilo nebo minimalizovalo riziko případně zkreslených výstupů ovlivňujících vstup pro budoucí operace (dále jen „smyčky zpětné vazby“, v angličtině. „feedback loops“) a aby se zajistilo, že tyto smyčky zpětné vazby budou řádně řešeny formou vhodných zmírňujících opatření.
Článek 15 5.
Vysoce rizikové systémy AI jsou odolné proti pokusům neoprávněných třetích stran změnit jejich použití, vstupy nebo výkonnost zneužitím zranitelných míst těchto systémů.

Technická řešení zaměřená na zajištění kybernetické bezpečnosti vysoce rizikových systémů AI odpovídají příslušným okolnostem a rizikům.

Technická řešení umožňující řešení zranitelných míst specifických pro AI v příslušných případech zahrnují opatření pro prevenci, detekci, řešení a kontrolu útoků, které se pokoušejí manipulovat soubory trénovacích dat (tzv. „data poisoning“), případně předtrénovaných komponent používaných při trénování (tzv. „model poisoning“), vstupů, jejichž cílem je přimět daný model AI k tomu, aby udělal chybu (tzv. „matoucí vzory“ nebo „vyhýbání se modelu“), útoků na důvěrnost nebo chyb modelů a také opatření týkající se reakcí na uvedené útoky.

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související standardy

2. Identifikované požadavky

Požadavky

3. Související standardy

Standardy
SCF AI & Autonomous Technologies Development Practices

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to:
(1) Achieve an appropriate level of accuracy, robustness and cybersecurity;
(2) Perform consistently in those respects throughout the AAT system's lifecycle; and
(3) Be effectively overseen by competent individuals.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Document accuracy and robustness requirements before adopting AI

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI design requirements checklist covering accuracy, robustness, cybersecurity

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI development standards
∙ Security-by-design requirements for AI

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI development security standards
∙ Formal SDLC integration
∙ Security testing requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI development framework
∙ AI security standards (NIST AI RMF, ISO 42001)
∙ DevSecOps integration for AI

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Measures exist to ensure AAT are designed and developed to:
(1) Achieve an appropriate level of accuracy, robustness and cybersecurity;
(2) Perform consistently in those respects throughout the AAT system's lifecycle; and
(3) Be effectively overseen by competent individuals.

Level 4 Quantitatively Controlled

Artificial Intelligence and Autonomous Technology (AAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Artificial Intelligence and Autonomous Technology (AAT) capabilities are "world class" efforts the leverage predictive analysis (e.g., machine learning and AI) to enable continuously improving capabilities. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF AI & Autonomous Technologies Implementation Documentation

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides:
(1) Contact details of the provider;
(2) Characteristics, capabilities and limitations of performance of the AAT;
(3) Errata from the AAT's initial conformity assessment;
(4) Details necessary to interpret the outputs of the AAT;
(5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT;
(6) Computational and hardware resources needed to operate the AAT;
(7) Projected useable lifetime of the AAT; and
(8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Document AI implementation steps and configuration

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI implementation documentation template

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI implementation documentation policy
∙ Technical documentation requirements

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI documentation program
∙ Standardized implementation documentation templates

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI documentation platform
∙ Automated documentation generation from MLOps tools
∙ Model cards and system cards

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides:
(1) Contact details of the provider;
(2) Characteristics, capabilities and limitations of performance of the AAT;
(3) Errata from the AAT's initial conformity assessment;
(4) Details necessary to interpret the outputs of the AAT;
(5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT;
(6) Computational and hardware resources needed to operate the AAT;
(7) Projected useable lifetime of the AAT; and
(8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Production Monitoring

Description

Mechanisms exist to monitor the functionality and behavior of the deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to monitor the functionality and behavior of the deployed AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Achieving Security, Compliance & Resilience Requirements

Description

Mechanisms exist to design Technology Assets, Applications and/or Services (TAAS) so that required capabilities continue to operate in a controlled and acceptable manner, when conditions are both routine and degraded.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 Planned Tracked

Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.
▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.
▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 Well Defined

Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.
▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).
▪ An implemented and operational capability exists to achieve resilience requirements in normal and adverse situations.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.