+Άρθρο 11 Αντιμετώπιση και ανάκαμψη
---+Άρθρο 11 1
---+Άρθρο 11 2
---+Άρθρο 11 3
---+Άρθρο 11 4
---+Άρθρο 11 5
---+Άρθρο 11 6
---+Άρθρο 11 7
---+Άρθρο 11 8
---+Άρθρο 11 9
---+Άρθρο 11 10
---+Άρθρο 11 11

Άρθρο 11 Αντιμετώπιση και ανάκαμψη

1. Επισκόπηση

,
Άρθρο 11 1

1.   Στο πλαίσιο διαχείρισης κινδύνων ΤΠΕ που αναφέρεται στο άρθρο 6 παράγραφος 1 και βάσει των απαιτήσεων προσδιορισμού που προβλέπονται στο άρθρο 8, οι χρηματοοικονομικές οντότητες θέτουν σε εφαρμογή ολοκληρωμένη πολιτική επιχειρησιακής συνέχειας των ΤΠΕ, η οποία μπορεί να εγκριθεί ως ειδική και συγκεκριμένη πολιτική, που συνιστά αναπόσπαστο μέρος της συνολικής πολιτικής επιχειρησιακής συνέχειας της χρηματοοικονομικής οντότητας.
Άρθρο 11 2

2.   Οι χρηματοοικονομικές οντότητες εφαρμόζουν την πολιτική επιχειρησιακής συνέχειας των ΤΠΕ μέσω ειδικών, κατάλληλων και τεκμηριωμένων ρυθμίσεων, σχεδίων, διαδικασιών και μηχανισμών, με στόχο:

α)

τη διασφάλιση της συνέχειας των κρίσιμων ή σημαντικών λειτουργιών της χρηματοοικονομικής οντότητας,

β)

την ταχεία, κατάλληλη και αποτελεσματική αντιμετώπιση και επίλυση όλων των συμβάντων που σχετίζονται με τις ΤΠΕ, κατά τρόπο ώστε να περιορίζεται η βλάβη και να δίνεται προτεραιότητα στην επανεκκίνηση των δραστηριοτήτων και στις ενέργειες αποκατάστασης,

γ)

την ενεργοποίηση, χωρίς καθυστέρηση, ειδικών σχεδίων που παρέχουν τη δυνατότητα εφαρμογής μέτρων, διαδικασιών και τεχνολογιών περιορισμού που αρμόζουν σε κάθε τύπο συμβάντος που σχετίζεται με τις ΤΠΕ και αποτρέπουν περαιτέρω βλάβες, καθώς και ειδικά προσαρμοσμένων διαδικασιών αντιμετώπισης και ανάκαμψης, οι οποίες θεσπίζονται σύμφωνα με το άρθρο 12,

δ)

την προκαταρκτική εκτίμηση επιπτώσεων, βλαβών και ζημιών,

ε)

τον καθορισμό δράσεων επικοινωνίας και διαχείρισης κρίσεων, οι οποίες διασφαλίζουν τη διαβίβαση επικαιροποιημένων πληροφοριών σε όλα τα μέλη του αρμόδιου εσωτερικού προσωπικού και τους εξωτερικούς συμφεροντούχους, σύμφωνα με το άρθρο 14, και αναφέρονται στις αρμόδιες αρχές σύμφωνα με το άρθρο 19.
Άρθρο 11 3

3.   Στο πλαίσιο της διαχείρισης κινδύνων ΤΠΕ που αναφέρεται στο άρθρο 6 παράγραφος 1, οι χρηματοοικονομικές οντότητες εφαρμόζουν σχετικά σχέδια αντιμετώπισης και ανάκαμψης της λειτουργίας των ΤΠΕ, τα οποία υπόκεινται, στην περίπτωση των χρηματοοικονομικών οντοτήτων πλην των πολύ μικρών επιχειρήσεων, σε ανεξάρτητη επανεξέταση εσωτερικής επιθεώρησης.
Άρθρο 11 4

4.   Οι χρηματοοικονομικές οντότητες θεσπίζουν, διατηρούν και υποβάλλουν περιοδικά σε δοκιμή κατάλληλα σχέδια επιχειρησιακής συνέχειας των ΤΠΕ, ιδίως όσον αφορά κρίσιμες ή σημαντικές λειτουργίες που αποτελούν αντικείμενο εξωτερικής ανάθεσης ή υπεργολαβίας μέσω ρυθμίσεων με τρίτους παρόχους υπηρεσιών ΤΠΕ.
Άρθρο 11 5

5.   Στο πλαίσιο της συνολικής πολιτικής επιχειρησιακής συνέχειας, οι χρηματοοικονομικές οντότητες διενεργούν ανάλυση επιχειρηματικών επιπτώσεων (ΑΕΕ) της έκθεσής τους σε σοβαρές διαταραχές της επιχειρηματικής δραστηριότητας. Στο πλαίσιο της ΑΕΕ, οι χρηματοοικονομικές οντότητες αξιολογούν τις πιθανές επιπτώσεις σοβαρών διαταραχών της επιχειρηματικής δραστηριότητας μέσω ποσοτικών και ποιοτικών κριτηρίων, χρησιμοποιώντας εσωτερικά και εξωτερικά δεδομένα και ανάλυση σεναρίων, κατά περίπτωση. Η ΑΕΕ εξετάζει την κρισιμότητα των προσδιορισμένων και χαρτογραφημένων επιχειρηματικών λειτουργιών, των διαδικασιών υποστήριξης, των εξαρτήσεων από τρίτους και των πληροφοριακών πόρων, καθώς και των αλληλεξαρτήσεών τους. Οι χρηματοοικονομικές οντότητες διασφαλίζουν ότι οι πόροι ΤΠΕ και οι υπηρεσίες ΤΠΕ σχεδιάζονται και χρησιμοποιούνται σε πλήρη ευθυγράμμιση με την ΑΕΕ, ιδίως όσον αφορά την επαρκή διασφάλιση της εφεδρείας όλων των κρίσιμων στοιχείων.
Άρθρο 11 6

6.   Στο πλαίσιο της ολοκληρωμένης διαχείρισης κινδύνων ΤΠΕ, οι χρηματοοικονομικές οντότητες:

α)

δοκιμάζουν τα σχέδια επιχειρησιακής συνέχειας των ΤΠΕ και τα σχέδια αντιμετώπισης και ανάκαμψης της λειτουργίας των ΤΠΕ σε σχέση με τα συστήματα ΤΠΕ που υποστηρίζουν όλες τις λειτουργίες τουλάχιστον σε ετήσια βάση, καθώς και σε περίπτωση τυχόν ουσιαστικών αλλαγών στα συστήματα ΤΠΕ που υποστηρίζουν κρίσιμες ή σημαντικές λειτουργίες,

β)

υποβάλλουν σε δοκιμή τα σχέδια επικοινωνίας σε καταστάσεις κρίσης που καταρτίζονται σύμφωνα με το άρθρο 14.

Για τους σκοπούς του πρώτου εδαφίου στοιχείο α), οι χρηματοοικονομικές οντότητες, πλην των πολύ μικρών επιχειρήσεων, περιλαμβάνουν στα σχέδια δοκιμών σενάρια κυβερνοεπιθέσεων και μετάβασης μεταξύ της κύριας υποδομής ΤΠΕ και της εφεδρικής χωρητικότητας, αντίγραφα ασφαλείας και εφεδρικές εγκαταστάσεις που απαιτούνται για την εκπλήρωση των υποχρεώσεων που προβλέπονται στο άρθρο 12.

Οι χρηματοοικονομικές οντότητες επανεξετάζουν ανά τακτά χρονικά διαστήματα τα σχέδια επιχειρησιακής συνέχειας των ΤΠΕ και αντιμετώπισης και ανάκαμψης της λειτουργίας των ΤΠΕ, λαμβάνοντας υπόψη τα αποτελέσματα των δοκιμών που διενεργούνται σύμφωνα με το πρώτο εδάφιο και τις συστάσεις που προκύπτουν από ελέγχους ή εποπτικές αξιολογήσεις.
Άρθρο 11 7

7.   Οι χρηματοοικονομικές οντότητες, πλην των πολύ μικρών επιχειρήσεων, διαθέτουν λειτουργία διαχείρισης κρίσεων, η οποία, σε περίπτωση ενεργοποίησης των σχεδίων επιχειρησιακής συνέχειας των ΤΠΕ ή των σχεδίων αντιμετώπισης και ανάκαμψης της λειτουργίας των ΤΠΕ, καθορίζει, μεταξύ άλλων, σαφείς διαδικασίες για τη διαχείριση της εσωτερικής και εξωτερικής επικοινωνίας σε καταστάσεις κρίσης σύμφωνα με το άρθρο 14.
Άρθρο 11 8

8.   Οι χρηματοοικονομικές οντότητες τηρούν εύκολα προσβάσιμα αρχεία δραστηριοτήτων προ και κατά τη διάρκεια γεγονότων διαταραχής, όταν ενεργοποιούνται τα σχέδια επιχειρησιακής συνέχειας των ΤΠΕ και τα σχέδια αντιμετώπισης και ανάκαμψης της λειτουργίας των ΤΠΕ.
Άρθρο 11 9

9.   Τα κεντρικά αποθετήρια τίτλων παρέχουν στις αρμόδιες αρχές αντίγραφα των αποτελεσμάτων των δοκιμών επιχειρησιακής συνέχειας των ΤΠΕ ή παρόμοιων δραστηριοτήτων.
Άρθρο 11 10

10.   Οι χρηματοοικονομικές οντότητες, πλην των πολύ μικρών επιχειρήσεων, υποβάλλουν στις αρμόδιες αρχές, κατόπιν αιτήματός τους, εκτίμηση των συγκεντρωτικών ετήσιων δαπανών και ζημιών, οι οποίες προκαλούνται από μείζονα συμβάντα που σχετίζονται με τις ΤΠΕ.
Άρθρο 11 11

11.   Σύμφωνα με το άρθρο 16 των κανονισμών (ΕΕ) αριθ. 1093/2010, (ΕΕ) αριθ. 1094/2010 και (ΕΕ) αριθ. 1095/2010, οι ΕΕΑ, μέσω της μεικτής επιτροπής, καταρτίζουν έως τις 17 Ιουλίου 2024 κοινές κατευθυντήριες γραμμές για την εκτίμηση των συγκεντρωτικών ετήσιων δαπανών και ζημιών που αναφέρονται στην παράγραφο 10.

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικά πρότυπα

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικά πρότυπα

Πρότυπα
SCF Business Continuity & Disaster Recovery Policy

Description

Mechanisms exist to establish a formal, documented Business Continuity and Disaster Recovery (BC/DR) policy that:
(1) Conveys executive management's intent;
(2) Provides organizational direction and expected behaviors;
(3) Is reviewed at least annually; and
(4) Is updated, as necessary, to adapt to evolving risks, threats and other changes that affect the organization.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review
∙ Policy acknowledgement tracking (e.g., HR onboarding records)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Documented annual policy review with version control

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Policy governance committee with formal annual review and approval workflow
∙ Automated policy attestation and acknowledgement tracking

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Steering committee
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Enterprise GRC platform (e.g., Cyturus, Archer, MetricStream, ServiceNow IRM) for policy lifecycle management
∙ Automated policy attestation, exception tracking and change history
∙ Annual executive approval and board-level reporting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.
▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Business Continuity Management System (BCMS)

Description

Mechanisms exist to operate a Business Continuity Management System (BCMS) to achieve resilient Technology Assets, Applications, Services and/or Data (TAASD) during:
(1) Routine operations; and
(2) Adverse conditions.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Continuity of Operations Plan (COOP)
∙ Business Continuity Plan (BCP)
∙ Disaster Recovery Plan (DRP)
∙ Business Impact Analysis (BIA)
∙ Criticality assessments

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Continuity of Operations Plan (COOP)
∙ Business Continuity Plan (BCP)
∙ Disaster Recovery Plan (DRP)
∙ Business Impact Analysis (BIA)
∙ Criticality assessments

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Continuity of Operations Plan (COOP)
∙ Business Continuity Plan (BCP)
∙ Disaster Recovery Plan (DRP)
∙ Business Impact Analysis (BIA)
∙ Criticality assessments

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Continuity of Operations Plan (COOP)
∙ Business Continuity Plan (BCP)
∙ Disaster Recovery Plan (DRP)
∙ Business Impact Analysis (BIA)
∙ Criticality assessments

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Continuity of Operations Plan (COOP)
∙ Business Continuity Plan (BCP)
∙ Disaster Recovery Plan (DRP)
∙ Business Impact Analysis (BIA)
∙ Criticality assessments

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs and redundant power).
▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 Planned Tracked

Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Business stakeholders and process owners identify business-critical TAASD and External Service Providers (ESPs).
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to identify single points of failure from a TAASD perspective.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to develop BC/DR plans to recover business-critical TAASD.
▪ Data/process owners conduct a Business Impact Analysis (BIA) at least annually, or after any major technology or process change, to identify TAASD that are critical to the business, as well as single points of failure.
▪ Business stakeholders and process owners designate alternative decision-makers if primary decision-makers are unavailable.

Level 3 Well Defined

Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.
▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of contingency planning controls to help ensure resilient Technology Assets, Applications and/or Services (TAAS) (e.g., Continuity of Operations Plan (COOP) or BC/DR playbooks).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Contingency Plan Testing & Exercises

Description

Mechanisms exist to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Tabletop exercises

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Tabletop exercises

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Tabletop exercises

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Tabletop exercises
∙ Simulated events

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Tabletop exercises
∙ Simulated events

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Business Continuity & Disaster Recovery (BCD) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with BCD domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Contingency management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Limited technologies exist to support near real-time network infrastructure failover (e.g., redundant ISPs and redundant power).
▪ IT and/or cybersecurity personnel develop limited Disaster Recovery Plans (DRP) to recover business-critical Technology Assets, Applications and/or Services (TAAS) and services.

Level 2 Planned Tracked

Business Continuity & Disaster Recovery (BCD) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Business Continuity / Disaster Recovery (BC/DR)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ BC/DR may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Business Continuity & Disaster Recovery (BCD) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with BCD domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with BCD domain capabilities are well-documented and kept current by process owners.
▪ A Business Continuity & Disaster Recovery (BC/DR) team, or similar function, is appropriately staffed and supported to implement and maintain BCD domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of BC/DR operations (e.g., BC/DR planning software, Disaster Recovery as a Service (DRaaS), Orchestration and Automation Tools).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with BCD domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct tests and/or exercises to evaluate the contingency plan's effectiveness and the organization's readiness to execute the plan.

Level 4 Quantitatively Controlled

Business Continuity & Disaster Recovery (BCD) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Risk Management Program

Description

Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:
(1) The organization's Enterprise Risk Management (ERM); and
(2) Industry-recognized cybersecurity risk management practices.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.
▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of strategic, operational and tactical risk management controls.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Business Impact Analysis (BIA)

Description

Mechanisms exist to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Risk Management Program

Description

Mechanisms exist to facilitate the implementation of strategic, operational and tactical risk management controls that are aligned with:
(1) The organization's Enterprise Risk Management (ERM); and
(2) Industry-recognized cybersecurity risk management practices.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.
▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of strategic, operational and tactical risk management controls.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Business Impact Analysis (BIA)

Description

Mechanisms exist to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Business Impact Analysis (BIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct a Business Impact Analysis (BIA) to identify and assess security, compliance and resilience risks.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.