+Άρθρο 31 Ορισμός κρίσιμων τρίτων παρόχων υπηρεσιών ΤΠΕ
---+Άρθρο 31 1
---+Άρθρο 31 2
---+Άρθρο 31 3
---+Άρθρο 31 4
---+Άρθρο 31 5
---+Άρθρο 31 6
---+Άρθρο 31 7
---+Άρθρο 31 8
---+Άρθρο 31 9
---+Άρθρο 31 10
---+Άρθρο 31 11
---+Άρθρο 31 12
---+Άρθρο 31 13
|
Άρθρο 31 Ορισμός κρίσιμων τρίτων παρόχων υπηρεσιών ΤΠΕ
1. Επισκόπηση
| Τίτλος |
Κανονισμός |
|
Άρθρο 31 1
|
1. Οι ΕΕΑ, μέσω της μεικτής επιτροπής και κατόπιν σύστασης του φόρουμ εποπτείας που συγκροτείται βάσει του άρθρου 32 παράγραφος 1:
|
α)
|
ορίζουν τους τρίτους παρόχους υπηρεσιών ΤΠΕ που είναι κρίσιμοι για τις χρηματοοικονομικές οντότητες, κατόπιν αξιολόγησης κατά την οποία λαμβάνονται υπόψη τα κριτήρια που καθορίζονται στην παράγραφο 2,
|
|
β)
|
ορίζουν ως κύριο εποπτικό φορέα για κάθε κρίσιμο τρίτο πάροχο υπηρεσιών ΤΠΕ την ΕΕΑ η οποία είναι υπεύθυνη, σύμφωνα με τους κανονισμούς (ΕΕ) αριθ. 1093/2010, (ΕΕ) αριθ. 1094/2010 ή (ΕΕ) αριθ. 1095/2010, για τις χρηματοοικονομικές οντότητες που έχουν από κοινού το μεγαλύτερο μερίδιο των συνολικών περιουσιακών στοιχείων επί της αξίας των συνολικών περιουσιακών στοιχείων όλων των χρηματοοικονομικών οντοτήτων που χρησιμοποιούν τις υπηρεσίες του σχετικού κρίσιμου τρίτου παρόχου υπηρεσιών ΤΠΕ, όπως αποδεικνύεται από το άθροισμα των επιμέρους ισολογισμών των εν λόγω χρηματοοικονομικών οντοτήτων.
|
|
|
Άρθρο 31 2
|
2. Ο ορισμός που αναφέρεται στην παράγραφο 1 στοιχείο α) βασίζεται σε όλα τα ακόλουθα κριτήρια σε σχέση με τις υπηρεσίες ΤΠΕ που παρέχονται από τρίτο πάροχο υπηρεσιών ΤΠΕ:
|
α)
|
τις συστημικές επιπτώσεις στη σταθερότητα, τη συνέχεια ή την ποιότητα της παροχής χρηματοοικονομικών υπηρεσιών σε περίπτωση που ο σχετικός τρίτος πάροχος υπηρεσιών ΤΠΕ αντιμετωπίσει λειτουργική ανεπάρκεια μεγάλης κλίμακας κατά την παροχή των υπηρεσιών του, λαμβάνοντας υπόψη τον αριθμό των χρηματοοικονομικών οντοτήτων και τη συνολική αξία των περιουσιακών στοιχείων των χρηματοοικονομικών οντοτήτων στις οποίες ο οικείος τρίτος πάροχος υπηρεσιών ΤΠΕ παρέχει τις υπηρεσίες του,
|
|
β)
|
τον συστημικό χαρακτήρα ή τη σημασία των χρηματοοικονομικών οντοτήτων οι οποίες βασίζονται στον οικείο τρίτο πάροχο υπηρεσιών ΤΠΕ, που αξιολογείται σύμφωνα με τις ακόλουθες παραμέτρους:
|
i)
|
τον αριθμό των παγκόσμιων συστημικώς σημαντικών ιδρυμάτων (G-SII) ή άλλων συστημικώς σημαντικών ιδρυμάτων (O-SII) που βασίζονται στον αντίστοιχο τρίτο πάροχο υπηρεσιών ΤΠΕ,
|
|
ii)
|
την αλληλεξάρτηση μεταξύ των G-SII ή των O-SII που αναφέρονται στο σημείο i) και άλλων χρηματοοικονομικών οντοτήτων, συμπεριλαμβανομένων των καταστάσεων στις οποίες τα G-SII ή τα O-SII παρέχουν υπηρεσίες χρηματοοικονομικών υποδομών σε άλλες χρηματοοικονομικές οντότητες,
|
|
|
γ)
|
την εξάρτηση των χρηματοοικονομικών οντοτήτων από τις υπηρεσίες που παρέχονται από τον σχετικό τρίτο πάροχο υπηρεσιών ΤΠΕ σε σχέση με κρίσιμες ή σημαντικές λειτουργίες χρηματοοικονομικών οντοτήτων στις οποίες συμμετέχει τελικά ο ίδιος τρίτος πάροχος υπηρεσιών ΤΠΕ, ανεξάρτητα από το αν οι χρηματοοικονομικές οντότητες στηρίζονται στις υπηρεσίες αυτές άμεσα ή έμμεσα, μέσω ρυθμίσεων υπεργολαβίας,
|
|
δ)
|
τη δυνατότητα υποκατάστασης του τρίτου παρόχου υπηρεσιών ΤΠΕ, λαμβάνοντας υπόψη τις ακόλουθες παραμέτρους:
|
i)
|
την έλλειψη πραγματικών εναλλακτικών επιλογών, έστω και εν μέρει, λόγω του περιορισμένου αριθμού τρίτων παρόχων υπηρεσιών ΤΠΕ που δραστηριοποιούνται σε συγκεκριμένη αγορά, ή του μεριδίου αγοράς του σχετικού τρίτου παρόχου υπηρεσιών ΤΠΕ ή της τεχνικής πολυπλοκότητας ή του εξειδικευμένου χαρακτήρα που απαιτείται, μεταξύ άλλων σε σχέση με τυχόν αποκλειστική τεχνολογία, ή των συγκεκριμένων χαρακτηριστικών της οργάνωσης ή της δραστηριότητας του τρίτου παρόχου υπηρεσιών ΤΠΕ,
|
|
ii)
|
δυσκολίες σε σχέση με τη μερική ή συνολική μεταφορά των σχετικών δεδομένων και του φόρτου εργασίας από τον οικείο τρίτο πάροχο υπηρεσιών ΤΠΕ σε άλλον τρίτο πάροχο υπηρεσιών ΤΠΕ, είτε λόγω του σημαντικού οικονομικού κόστους, του χρόνου ή άλλου πόρου που μπορεί να συνεπάγεται η διαδικασία μεταφοράς είτε λόγω αυξημένων κινδύνων ΤΠΕ ή άλλων λειτουργικών κινδύνων στους οποίους ενδέχεται να εκτεθεί η χρηματοοικονομική οντότητα λόγω της μεταφοράς αυτής.
|
|
|
|
Άρθρο 31 3
|
3. Όταν ο τρίτος πάροχος υπηρεσιών ΤΠΕ ανήκει σε όμιλο, τα κριτήρια που αναφέρονται στην παράγραφο 2 λαμβάνονται υπόψη σε σχέση με τις υπηρεσίες ΤΠΕ που παρέχονται από τον όμιλο στο σύνολό του.
|
|
Άρθρο 31 4
|
4. Οι κρίσιμοι τρίτοι πάροχοι υπηρεσιών ΤΠΕ που αποτελούν μέρος ομίλου ορίζουν ένα νομικό πρόσωπο ως σημείο συντονισμού για τη διασφάλιση επαρκούς εκπροσώπησης και επικοινωνίας με τον κύριο εποπτικό φορέα.
|
|
Άρθρο 31 5
|
5. Ο κύριος εποπτικός φορέας κοινοποιεί στον τρίτο πάροχο υπηρεσιών ΤΠΕ το αποτέλεσμα της αξιολόγησης που οδηγεί στον ορισμό που αναφέρεται στην παράγραφο 1 στοιχείο α). Εντός 6 εβδομάδων από την ημερομηνία της κοινοποίησης, ο τρίτος πάροχος υπηρεσιών ΤΠΕ μπορεί να υποβάλει στον κύριο εποπτικό φορέα αιτιολογημένη δήλωση με κάθε σχετική πληροφορία για τους σκοπούς της αξιολόγησης. Ο κύριος εποπτικός φορέας εξετάζει την αιτιολογημένη δήλωση και μπορεί να ζητήσει την υποβολή πρόσθετων πληροφοριών εντός 30 ημερολογιακών ημερών από την παραλαβή της εν λόγω δήλωσης.
Μετά τον ορισμό τρίτου παρόχου υπηρεσιών ΤΠΕ ως κρίσιμου, οι ΕΕΑ, μέσω της μεικτής επιτροπής, κοινοποιούν στον τρίτο πάροχο υπηρεσιών ΤΠΕ τον εν λόγω ορισμό και την ημερομηνία έναρξης από την οποία θα υπόκεινται ουσιαστικά σε δραστηριότητες εποπτείας. Η εν λόγω ημερομηνία έναρξης δεν υπερβαίνει τον ένα μήνα μετά την κοινοποίηση. Ο τρίτος πάροχος υπηρεσιών ΤΠΕ κοινοποιεί στις χρηματοοικονομικές οντότητες στις οποίες παρέχει υπηρεσίες τον χαρακτηρισμό τους ως κρίσιμων.
|
|
Άρθρο 31 6
|
6. Ανατίθεται στην Επιτροπή η εξουσία να εκδώσει κατ’ εξουσιοδότηση πράξη, σύμφωνα με το άρθρο 57, για τη συμπλήρωση του παρόντος κανονισμού, προσδιορίζοντας περαιτέρω τα κριτήρια που προβλέπονται στην παράγραφο 2 του παρόντος άρθρου έως τις 17 Ιουλίου 2024.
|
|
Άρθρο 31 7
|
7. Ο ορισμός που αναφέρεται στην παράγραφο 1 στοιχείο α) δεν χρησιμοποιείται έως ότου η Επιτροπή εκδώσει κατ’ εξουσιοδότηση πράξη σύμφωνα με την παράγραφο 6.
|
|
Άρθρο 31 8
|
8. Ο ορισμός που αναφέρεται στην παράγραφο 1 στοιχείο α) δεν εφαρμόζεται στα ακόλουθα:
|
i)
|
χρηματοοικονομικές οντότητες που παρέχουν υπηρεσίες ΤΠΕ σε άλλες χρηματοοικονομικές οντότητες,
|
|
ii)
|
τρίτους παρόχους υπηρεσιών ΤΠΕ που υπόκεινται σε πλαίσια εποπτείας, τα οποία έχουν θεσπιστεί με σκοπό την υποστήριξη των καθηκόντων που αναφέρονται στο άρθρο 127 παράγραφος 2 της Συνθήκης για τη λειτουργία της Ευρωπαϊκής Ένωσης,
|
|
iii)
|
ενδοομιλικούς παρόχους υπηρεσιών ΤΠΕ,
|
|
iv)
|
τρίτους παρόχους υπηρεσιών ΤΠΕ που παρέχουν υπηρεσίες ΤΠΕ αποκλειστικά σε ένα κράτος μέλος σε χρηματοοικονομικές οντότητες που δραστηριοποιούνται μόνο στο εν λόγω κράτος μέλος.
|
|
|
Άρθρο 31 9
|
9. Οι ΕΕΑ, μέσω της μεικτής επιτροπής, καταρτίζουν, δημοσιεύουν και επικαιροποιούν ετησίως τον κατάλογο των κρίσιμων τρίτων παρόχων υπηρεσιών ΤΠΕ σε επίπεδο Ένωσης.
|
|
Άρθρο 31 10
|
10. Για τους σκοπούς της παραγράφου 1 στοιχείο α), οι αρμόδιες αρχές διαβιβάζουν, σε ετήσια και συγκεντρωτική βάση, τις εκθέσεις που αναφέρονται στο άρθρο 28 παράγραφος 3 τρίτο εδάφιο στο φόρουμ εποπτείας, το οποίο συγκροτείται σύμφωνα με το άρθρο 32. Το φόρουμ εποπτείας αξιολογεί τις εξαρτήσεις των τρίτων παρόχων ΤΠΕ από χρηματοοικονομικές οντότητες βάσει των πληροφοριών που λαμβάνει από τις αρμόδιες αρχές.
|
|
Άρθρο 31 11
|
11. Οι τρίτοι πάροχοι υπηρεσιών ΤΠΕ που δεν περιλαμβάνονται στον κατάλογο που αναφέρεται στην παράγραφο 9 μπορούν να ζητήσουν να οριστούν ως κρίσιμοι σύμφωνα με την παράγραφο 1 στοιχείο α).
Για τους σκοπούς του πρώτου εδαφίου, ο τρίτος πάροχος υπηρεσιών ΤΠΕ υποβάλλει αιτιολογημένη αίτηση στην ΕΑΤ, την ΕΑΚΑΑ ή την ΕΑΑΕΣ, οι οποίες αποφασίζουν, μέσω της μεικτής επιτροπής, αν ο εν λόγω τρίτος πάροχος υπηρεσιών ΤΠΕ θα οριστεί ως κρίσιμος σύμφωνα με την παράγραφο 1 στοιχείο α).
Η απόφαση που αναφέρεται στο δεύτερο εδάφιο εκδίδεται και κοινοποιείται στον τρίτο πάροχο υπηρεσιών ΤΠΕ εντός 6 μηνών από την παραλαβή της αίτησης.
|
|
Άρθρο 31 12
|
12. Οι χρηματοοικονομικές οντότητες χρησιμοποιούν τις υπηρεσίες τρίτου παρόχου υπηρεσιών ΤΠΕ που είναι εγκατεστημένος σε τρίτη χώρα και έχει οριστεί ως κρίσιμος, σύμφωνα με την παράγραφο 1 στοιχείο α) μόνο εφόσον ο εν λόγω πάροχος έχει εγκαταστήσει θυγατρική στην Ένωση εντός των 12 μηνών μετά τον ορισμό.
|
|
Άρθρο 31 13
|
13. Ο κρίσιμος τρίτος πάροχος υπηρεσιών ΤΠΕ που αναφέρεται στην παράγραφο 12 κοινοποιεί στον κύριο εποπτικό φορέα τυχόν αλλαγές στη δομή της διοίκησης της θυγατρικής που είναι εγκατεστημένη στην Ένωση.
|
,
1.1 Παραπομπές
1.2 Εντοπισμένες απαιτήσεις
1.3 Σχετικά πρότυπα
2. Εντοπισμένες απαιτήσεις
3. Σχετικά πρότυπα
Πρότυπα
| Πηγή |
Απαίτηση |
|
SCF
|
Contacts With Authorities
Description
Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Documented list of law enforcement and regulatory contacts (FBI, CISA, state AG)
∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Documented contacts with FBI Cyber Division, CISA, and relevant regulators
∙ MS-ISAC or sector-specific ISAC membership
∙ Pre-established law enforcement liaisons for incident response
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Integrated Security Incident Response Team (ISIRT) with defined authority contacts
∙ CISA Cyber Liaison and FBI Cyber Division contacts
∙ Sector ISAC membership (e.g., FS-ISAC, H-ISAC, E-ISAC)
∙ Regulatory notification contact list (e.g., FTC, OCR, state regulators)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Integrated Security Incident Response Team (ISIRT) with pre-established authority relationships
∙ Formal engagement with law enforcement (FBI, USSS, CISA)
∙ Sector ISAC active membership with information sharing participation
∙ Regulatory breach notification contacts and documented procedures
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Dedicated government liaison program (FBI, CISA, NSA, sector regulators)
∙ Active ISAC membership with classified threat briefing access (where applicable)
∙ Pre-established breach notification workflows for all applicable regulators
∙ Integrated Security Incident Response Team (ISIRT) with 24/7 law enforcement contact protocols
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.
▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.
▪ Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
Level 2 Planned Tracked
Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ An implemented and operational capability exists to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Level 4 Quantitatively Controlled
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|