+Continuous Monitoring
---+Intrusion Detection & Prevention Systems (IDS & IPS)
---+Automated Tools for Real-Time Analysis
---+Inbound & Outbound Communications Traffic
---+System Generated Alerts
---+Wireless Network Monitoring
---+Host-Based Devices
---+File Integrity Monitoring (FIM)
---+Security Event Monitoring
---+Proxy Logging
---+Deactivated Account Activity
---+Automated Response to Suspicious Events
---+Automated Alerts
---+Alert Threshold Tuning
---+Individuals Posing Greater Risk
---+Privileged User Oversight
---+Analyze and Prioritize Monitoring Requirements
---+Real-Time Session Monitoring

Continuous Monitoring

Description

Mechanisms exist to facilitate the implementation of enterprise-wide monitoring controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Centralized event logging
∙ Managed Security Services Provider (MSSP)
∙ Cloud-native SIEM (e.g., Microsoft Sentinel free tier, Elastic SIEM free)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Centralized event logging
∙ Managed Security Services Provider (MSSP)
∙ Cloud SIEM (e.g., Microsoft Sentinel, Elastic SIEM, Sumo Logic)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Centralized event logging
∙ Security Incident Event Management (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar)
∙ Managed Security Services Provider (MSSP)
∙ Security Operations Center (SOC)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise SIEM platform (e.g., Splunk Enterprise Security, IBM QRadar, Microsoft Sentinel)
∙ 24/7 Security Operations Center (SOC)
∙ Security Orchestration, Automation & Response (SOAR)
∙ Threat intelligence integration
∙ Managed Detection & Response (MDR) or in-house SOC

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred.
▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors.
▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD).

Level 2 Planned Tracked

Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines).
▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs.
▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis.
▪ An implemented and operational capability exists to facilitate the implementation of enterprise-wide monitoring controls.

Level 4 Quantitatively Controlled

Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1. Overview

Summary	Standard
Intrusion Detection & Prevention Systems (IDS & IPS)	Description Mechanisms exist to implement Intrusion Detection / Prevention Systems (IDS / IPS) technologies on critical systems, key network segments and network choke points. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Intrusion Detection / Prevention Systems (IDS/IPS) ∙ Next-Generation Firewall (NGFW) with IPS (e.g., Fortinet FortiGate, Palo Alto) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Intrusion Detection / Prevention Systems (IDS/IPS) ∙ Next-Generation Firewall (NGFW) with built-in IPS (e.g., Fortinet, Palo Alto) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Intrusion Detection / Prevention Systems (IDS/IPS) ∙ Next-Generation Firewall (NGFW) with IPS ∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, SentinelOne, Microsoft Defender XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Intrusion Detection / Prevention Systems (IDS/IPS) ∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, Palo Alto Cortex XDR) ∙ Network Detection and Response (NDR) (e.g., Darktrace, ExtraHop) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise IDS/IPS integrated with SIEM ∙ Extended Detection and Response (XDR) (e.g., CrowdStrike Falcon, Palo Alto Cortex XDR) ∙ Network Detection and Response (NDR) (e.g., Darktrace, ExtraHop, Vectra AI) ∙ AI-driven anomaly detection SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to implement Intrusion Detection / Prevention Systems (IDS / IPS) technologies on critical systems, key network segments and network choke points. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Automated Tools for Real-Time Analysis	Description Mechanisms exist to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support near real-time analysis and incident escalation. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) ∙ Cloud SIEM with automated alerting (e.g., Microsoft Sentinel, Elastic SIEM) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Managed Security Services Provider (MSSP) ∙ Cloud SIEM (e.g., Microsoft Sentinel, Sumo Logic) ∙ Automated alert rules for common attack patterns Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Management (SIEM) (e.g., Splunk, Microsoft Sentinel, IBM QRadar) ∙ Security Orchestration, Automation & Response (SOAR) (e.g., Splunk SOAR, Palo Alto XSOAR) ∙ Extended Detection and Response (XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ SIEM with automated analytics (e.g., Splunk, Microsoft Sentinel) ∙ Security Orchestration, Automation & Response (SOAR) (e.g., Splunk SOAR, Palo Alto XSOAR) ∙ Extended Detection and Response (XDR) ∙ User and Entity Behavior Analytics (UEBA) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise SIEM with AI/ML-driven analytics (e.g., Splunk ES, IBM QRadar with AI) ∙ SOAR platform for automated response (e.g., Splunk SOAR, Palo Alto XSOAR) ∙ XDR / MDR platform ∙ UEBA integrated with SIEM ∙ Threat hunting capability SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD. ▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to utilize a Security Incident Event Manager (SIEM), or similar automated tool, to support near real-time analysis and incident escalation. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Inbound & Outbound Communications Traffic	Description Mechanisms exist to continuously monitor inbound and outbound communications traffic for unusual or unauthorized activities or conditions. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. ▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD). Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to continuously monitor inbound and outbound communications traffic for unusual or unauthorized activities or conditions. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
System Generated Alerts	Description Mechanisms exist to generate, monitor, correlate and respond to alerts from physical, cybersecurity, data protection and supply chain activities to achieve integrated situational awareness. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ SBC enforce logging to link system access to individual users or service accounts using a non-repudiation capability to protect against an individual falsely denying having performed a particular action. ▪ SBC enforce local security event logging and forward those logs to a centralized log repository to provide an alternate audit capability in the event of a failure in the primary audit capability. ▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD. ▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to generate, monitor, correlate and respond to alerts from physical, cybersecurity, data protection and supply chain activities to achieve integrated situational awareness. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Wireless Network Monitoring	Description Mechanisms exist to monitor wireless network segments for: (1) Rogue wireless devices; and (2) Anomalous and/or hostile activities. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) ∙ Extended Detection and Response (XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) ∙ Extended Detection and Response (XDR) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Wireless Intrusion Detection / Protection Systems (WIDS / WIPS) ∙ Extended Detection and Response (XDR) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to monitor wireless network segments for: (1) Rogue wireless devices; and (2) Anomalous and/or hostile activities. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Host-Based Devices	Description Mechanisms exist to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) to actively alert on or block unwanted activities and send logs to a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) ∙ Extended Detection and Response (XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) ∙ Extended Detection and Response (XDR) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) ∙ Extended Detection and Response (XDR) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to utilize Host-based Intrusion Detection / Prevention Systems (HIDS / HIPS) to actively alert on or block unwanted activities and send logs to a Security Incident Event Manager (SIEM), or similar automated tool, to maintain situational awareness. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
File Integrity Monitoring (FIM)	Description Mechanisms exist to utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ File Integrity Monitoring (FIM) via endpoint security tool (e.g., OSSEC free, Wazuh free) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ File Integrity Monitor (FIM) (e.g., Wazuh free, OSSEC, Tripwire free edition) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ File Integrity Monitor (FIM) ∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak) ∙ Netwrix Auditor (https://netwrix.com) ∙ Wazuh (free, open-source) (https://wazuh.com) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ File Integrity Monitor (FIM) ∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak) ∙ Netwrix Auditor (https://netwrix.com) ∙ Tripwire Enterprise (https://tripwire.com) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise FIM solution (e.g., Tripwire Enterprise, CimTrak, Qualys FIM) ∙ CimTrak Integrity Suite (https://cimcor.com/cimtrak) ∙ FIM integrated with SIEM for real-time alerting ∙ CIS Control 10 (Malware Defenses) alignment SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to utilize a File Integrity Monitor (FIM), or similar change-detection technology, on critical Technology Assets, Applications and/or Services (TAAS) to generate alerts for unauthorized modifications. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Security Event Monitoring	Description Mechanisms exist to review event logs on an ongoing basis and escalate incidents in accordance with established timelines and procedures. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. ▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD). Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ A log aggregator, or similar automated tool, provides an event log report generation capability to aid in detecting and assessing anomalous activities on business-critical TAASD. ▪ IT and/or cybersecurity personnel configure alerts for critical or sensitive data that is stored, transmitted and processed on assets. ▪ Logs of privileged functions (e.g., administrator or root actions) are reviewed for evidence of unauthorized activities. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to review event logs on an ongoing basis and escalate incidents in accordance with established timelines and procedures. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Proxy Logging	Description Mechanisms exist to log all Internet-bound requests, in order to identify prohibited activities and assist incident handlers with identifying potentially compromised systems. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Review system logs periodically Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Log monitoring policy ∙ Regular review of key system logs Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ SIEM (e.g., Wazuh) ∙ Automated log collection and alerting Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise SIEM (e.g., Splunk, IBM QRadar) ∙ Continuous monitoring program ∙ SOC monitoring Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise SIEM/SOAR platform ∙ 24/7 SOC monitoring ∙ Threat hunting ∙ Automated incident response SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Continuous Monitoring (MON) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with MON domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Event monitoring-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Monitoring is primarily reactive in nature, focused on identifying incidents that occurred. ▪ Event log reviews primarily rely on manual processes to identify anomalous behaviors. ▪ Generating event logs and the review of those event logs is narrowly-focused to business-critical Technology Assets, Applications, Services and/or Data (TAASD). Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to log all Internet-bound requests, in order to identify prohibited activities and assist incident handlers with identifying potentially compromised systems. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Deactivated Account Activity	Description Mechanisms exist to monitor deactivated accounts for attempted usage. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to monitor deactivated accounts for attempted usage. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Automated Response to Suspicious Events	Description Automated mechanisms exist to implement pre-determined corrective actions in response to detected events that have security incident implications. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Review system logs periodically Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Log monitoring policy ∙ Regular review of key system logs Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Intrusion Detection / Prevention Systems (IDS / IPS) ∙ Extended Detection and Response (XDR) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to automatically implement pre-determined corrective actions in response to detected events that have security incident implications. Level 4 Quantitatively Controlled Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
Automated Alerts	Description Mechanisms exist to automatically alert incident response personnel to inappropriate or anomalous activities that have potential security incident implications. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to automatically alert incident response personnel to inappropriate or anomalous activities that have potential security incident implications. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Alert Threshold Tuning	Description Mechanisms exist to "tune" event monitoring technologies through analyzing communications traffic/event patterns and developing profiles representing common traffic patterns and/or events. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to "tune" event monitoring technologies through analyzing communications traffic/event patterns and developing profiles representing common traffic patterns and/or events. Level 4 Quantitatively Controlled Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
Individuals Posing Greater Risk	Description Mechanisms exist to implement enhanced activity monitoring for individuals who have been identified as posing an increased level of risk. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to implement enhanced activity monitoring for individuals who have been identified as posing an increased level of risk. Level 4 Quantitatively Controlled Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
Privileged User Oversight	Description Mechanisms exist to implement enhanced activity monitoring for privileged users. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Managed Security Services Provider (MSSP) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Security Incident Event Manager (SIEM) ∙ Managed Security Services Provider (MSSP) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to implement enhanced activity monitoring for privileged users. Level 4 Quantitatively Controlled Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Continuous Monitoring (MON) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
Analyze and Prioritize Monitoring Requirements	Description Mechanisms exist to assess the organization's needs for monitoring and prioritize the monitoring of Technology Assets, Applications and/or Services (TAAS), based on TAAS criticality and the sensitivity of the data it stores, transmits and processes. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Review system logs periodically Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Log monitoring policy ∙ Regular review of key system logs Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ SIEM (e.g., Wazuh) ∙ Automated log collection and alerting Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise SIEM (e.g., Splunk, IBM QRadar) ∙ Continuous monitoring program ∙ SOC monitoring Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise SIEM/SOAR platform ∙ 24/7 SOC monitoring ∙ Threat hunting ∙ Automated incident response SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Continuous Monitoring (MON) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with MON domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Continuous monitoring-related controls are primarily administrative and preventative in nature (e.g., policies, standards, procedures & guidelines). ▪ Continuous monitoring may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to assess the organization's needs for monitoring and prioritize the monitoring of Technology Assets, Applications and/or Services (TAAS), based on TAAS criticality and the sensitivity of the data it stores, transmits and processes. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Real-Time Session Monitoring	Description Mechanisms exist to enable authorized personnel the ability to remotely view and hear content related to an established user session in real time, in accordance with organizational standards, as well as statutory, regulatory and contractual obligations. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Review system logs periodically Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Log monitoring policy ∙ Regular review of key system logs Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ SIEM (e.g., Wazuh) ∙ Automated log collection and alerting Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Enterprise SIEM (e.g., Splunk, IBM QRadar) ∙ Continuous monitoring program ∙ SOC monitoring Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise SIEM/SOAR platform ∙ 24/7 SOC monitoring ∙ Threat hunting ∙ Automated incident response SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked SCR-CMM Level 2 criteria definitions are not available for this control: ▪ A reasonable person would conclude a well-defined and standardized process is required. ▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization. ▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts). Level 3 Well Defined Continuous Monitoring (MON) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with MON domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Cybersecurity personnel use a structured process via Standardized Operating Procedures (SOP) to review and analyze logs. ▪ A Security Operations Center (SOC) team, or similar function, is appropriately staffed and supported to implement and maintain MON domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of continuous monitoring operations (e.g., Security Incident Event Manager (SIEM), etc.). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with MON domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ Secure Baseline Configurations (SBC) enforce security event logging to contain sufficient information to establish necessary details of activity and allow for forensics analysis. ▪ An implemented and operational capability exists to enable authorized personnel the ability to remotely view and hear content related to an established user session in real time, in accordance with organizational standards, as well as statutory, regulatory and contractual obligations. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

DORA Ch. II Sec. II Art. 10 3. (DORA)

2. Identified Requirements

Requirements
Source	Requirement

3. Related Regulations

Regulations
Source	Regulation
DORA	DORA Ch. II Sec. II Art. 10 3. 3. Financial entities shall devote sufficient resources and capabilities to monitor user activity, the occurrence of ICT anomalies and ICT-related incidents, in particular cyber-attacks.

Linked Issues

Issuelinks
Linktype	Issue
is related to	Annual
is related to	relative Control Weighting = 10
is related to	Technology
is related to	Govern
is related to	SCRM Focus Tier 1 STRATEGIC
is related to	SCRM Focus Tier 2 OPERATIONAL
is related to	SCRM Focus Tier 3 TACTICAL
blocks	Unauthorized access
blocks	Lost, damaged or stolen asset(s)
blocks	Loss of integrity through unauthorized changes
blocks	Emergent properties and/or unintended consequences
blocks	Business interruption
blocks	Data loss / corruption
blocks	Reduction in productivity
blocks	Information loss / corruption or system compromise due to technical attack
blocks	Information loss / corruption or system compromise due to non‐technical attack
blocks	Loss of revenue
blocks	Cancelled contract
blocks	Diminished competitive advantage
blocks	Diminished reputation
blocks	Fines and judgements
blocks	Unmitigated vulnerabilities
blocks	System compromise
blocks	Inability to support business processes
blocks	Incorrect controls scoping
blocks	Lack of roles & responsibilities
blocks	Inadequate internal practices
blocks	Inadequate third-party practices
blocks	Lack of oversight of internal controls
blocks	Lack of oversight of third-party controls
blocks	Inability to investigate / prosecute incidents
blocks	Improper response to incidents
blocks	Ineffective remediation actions
blocks	Expense associated with managing a loss event
blocks	Inability to maintain situational awareness
blocks	Third-party cybersecurity exposure
blocks	Third-party physical security exposure
blocks	Third-party supply chain relationships, visibility and controls
blocks	Third-party compliance / legal exposure
blocks	Use of product / service
blocks	Reliance on the third-party
blocks	Data Obfuscation
blocks	Junk Data
blocks	Steganography
blocks	Protocol or Service Impersonation
blocks	OS Credential Dumping
blocks	LSASS Memory
blocks	Security Account Manager
blocks	NTDS
blocks	LSA Secrets
blocks	Cached Domain Credentials
blocks	DCSync
blocks	Proc Filesystem
blocks	/etc/passwd and /etc/shadow
blocks	Data from Local System
blocks	Fallback Channels
blocks	Exfiltration Over Other Network Medium
blocks	Exfiltration Over Bluetooth
blocks	Traffic Duplication
blocks	Remote Services
blocks	Remote Desktop Protocol
blocks	SMB/Windows Admin Shares
blocks	Distributed Component Object Model
blocks	SSH
blocks	VNC
blocks	Windows Remote Management
blocks	Direct Cloud VM Connections
blocks	Data from Removable Media
blocks	Obfuscated Files or Information
blocks	Software Packing
blocks	Dynamic API Resolution
blocks	Stripped Payloads
blocks	Embedded Payloads
blocks	Command Obfuscation
blocks	Fileless Storage
blocks	LNK Icon Smuggling
blocks	Scheduled Transfer
blocks	Data Transfer Size Limits
blocks	Masquerading
blocks	Invalid Code Signature
blocks	Rename Legitimate Utilities
blocks	Match Legitimate Resource Name or Location
blocks	Double File Extension
blocks	Masquerade File Type
blocks	Masquerade Account Name
blocks	Boot or Logon Initialization Scripts
blocks	Login Hook
blocks	Network Logon Script
blocks	RC Scripts
blocks	Startup Items
blocks	Network Sniffing
blocks	Exfiltration Over C2 Channel
blocks	Network Service Discovery
blocks	Windows Management Instrumentation
blocks	Exfiltration Over Alternative Protocol
blocks	Exfiltration Over Symmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Unencrypted Non-C2 Protocol
blocks	Exfiltration Over Physical Medium
blocks	Exfiltration over USB
blocks	Scheduled Task/Job
blocks	At
blocks	Cron
blocks	Scheduled Task
blocks	Systemd Timers
blocks	Process Injection
blocks	Dynamic-link Library Injection
blocks	Portable Executable Injection
blocks	Thread Execution Hijacking
blocks	Asynchronous Procedure Call
blocks	Thread Local Storage
blocks	Ptrace System Calls
blocks	Proc Memory
blocks	Extra Window Memory Injection
blocks	Process Hollowing
blocks	Process Doppelgänging
blocks	VDSO Hijacking
blocks	GUI Input Capture
blocks	Command and Scripting Interpreter
blocks	PowerShell
blocks	AppleScript
blocks	Windows Command Shell
blocks	Unix Shell
blocks	Visual Basic
blocks	Python
blocks	JavaScript
blocks	Network Device CLI
blocks	Cloud API
blocks	AutoHotKey & AutoIT
blocks	Lua
blocks	Exploitation for Privilege Escalation
blocks	Indicator Removal
blocks	Clear Command History
blocks	Clear Network Connection History and Configurations
blocks	Clear Mailbox Data
blocks	Clear Persistence
blocks	Relocate Malware
blocks	Application Layer Protocol
blocks	Web Protocols
blocks	File Transfer Protocols
blocks	Mail Protocols
blocks	DNS
blocks	Publish/Subscribe Protocols
blocks	Software Deployment Tools
blocks	Valid Accounts
blocks	Default Accounts
blocks	Domain Accounts
blocks	Local Accounts
blocks	Cloud Accounts
blocks	Taint Shared Content
blocks	Account Discovery
blocks	Local Account
blocks	Domain Account
blocks	Proxy
blocks	Internal Proxy
blocks	External Proxy
blocks	Replication Through Removable Media
blocks	Communication Through Removable Media
blocks	Non-Application Layer Protocol
blocks	Account Manipulation
blocks	Additional Cloud Credentials
blocks	Additional Email Delegate Permissions
blocks	Additional Cloud Roles
blocks	SSH Authorized Keys
blocks	Additional Local or Domain Groups
blocks	Web Service
blocks	Dead Drop Resolver
blocks	Bidirectional Communication
blocks	One-Way Communication
blocks	Multi-Stage Channels
blocks	Ingress Tool Transfer
blocks	Native API
blocks	Brute Force
blocks	Password Guessing
blocks	Password Cracking
blocks	Password Spraying
blocks	Credential Stuffing
blocks	Multi-Factor Authentication Interception
blocks	Email Collection
blocks	Local Email Collection
blocks	Remote Email Collection
blocks	Email Forwarding Rule
blocks	Automated Collection
blocks	Trusted Developer Utilities Proxy Execution
blocks	MSBuild
blocks	ClickOnce
blocks	Shared Modules
blocks	Data Encoding
blocks	Standard Encoding
blocks	Non-Standard Encoding
blocks	External Remote Services
blocks	Network Share Discovery
blocks	Create Account
blocks	Local Account
blocks	Domain Account
blocks	Cloud Account
blocks	Office Application Startup
blocks	Office Template Macros
blocks	Software Extensions
blocks	Browser Session Hijacking
blocks	Forced Authentication
blocks	Drive-by Compromise
blocks	Exploit Public-Facing Application
blocks	Supply Chain Compromise
blocks	Compromise Software Dependencies and Development Tools
blocks	BITS Jobs
blocks	Password Policy Discovery
blocks	Exploitation for Client Execution
blocks	User Execution
blocks	Malicious Link
blocks	Malicious File
blocks	Malicious Image
blocks	Traffic Signaling
blocks	Port Knocking
blocks	Socket Filters
blocks	Exploitation of Remote Services
blocks	Exploitation for Stealth
blocks	Exploitation for Credential Access
blocks	Data from Information Repositories
blocks	Confluence
blocks	Sharepoint
blocks	Customer Relationship Management Software
blocks	Messaging Applications
blocks	System Script Proxy Execution
blocks	PubPrn
blocks	System Binary Proxy Execution
blocks	Compiled HTML File
blocks	Control Panel
blocks	CMSTP
blocks	InstallUtil
blocks	Mshta
blocks	Odbcconf
blocks	Regsvcs/Regasm
blocks	Regsvr32
blocks	Rundll32
blocks	Verclsid
blocks	Mavinject
blocks	MMC
blocks	Electron Applications
blocks	Remote Access Tools
blocks	XSL Script Processing
blocks	Template Injection
blocks	File and Directory Permissions Modification
blocks	Windows Permissions
blocks	Linux and Mac Permissions
blocks	Domain or Tenant Policy Modification
blocks	Data Destruction
blocks	Data Encrypted for Impact
blocks	Service Stop
blocks	Inhibit System Recovery
blocks	Defacement
blocks	Internal Defacement
blocks	External Defacement
blocks	Endpoint Denial of Service
blocks	OS Exhaustion Flood
blocks	Service Exhaustion Flood
blocks	Application Exhaustion Flood
blocks	Application or System Exploitation
blocks	Server Software Component
blocks	Transport Agent
blocks	Web Shell
blocks	IIS Components
blocks	Terminal Services DLL
blocks	Implant Internal Image
blocks	Steal Application Access Token
blocks	Data from Cloud Storage
blocks	Transfer Data to Cloud Account
blocks	Steal Web Session Cookie
blocks	ROMMONkit
blocks	TFTP Boot
blocks	Create or Modify System Process
blocks	Systemd Service
blocks	Screensaver
blocks	Windows Management Instrumentation Event Subscription
blocks	Unix Shell Configuration Modification
blocks	LC_LOAD_DYLIB Addition
blocks	Accessibility Features
blocks	PowerShell Profile
blocks	Emond
blocks	Installer Packages
blocks	Authentication Package
blocks	Time Providers
blocks	Winlogon Helper DLL
blocks	Security Support Provider
blocks	Kernel Modules and Extensions
blocks	Re-opened Applications
blocks	LSASS Driver
blocks	Shortcut Modification
blocks	Print Processors
blocks	XDG Autostart Entries
blocks	Abuse Elevation Control Mechanism
blocks	Setuid and Setgid
blocks	Bypass User Account Control
blocks	Sudo and Sudo Caching
blocks	Elevated Execution with Prompt
blocks	TCC Manipulation
blocks	Application Access Token
blocks	Pass the Ticket
blocks	Unsecured Credentials
blocks	Credentials In Files
blocks	Credentials in Registry
blocks	Shell History
blocks	Private Keys
blocks	Cloud Instance Metadata API
blocks	Group Policy Preferences
blocks	Chat Messages
blocks	Subvert Trust Controls
blocks	Gatekeeper Bypass
blocks	SIP and Trust Provider Hijacking
blocks	Install Root Certificate
blocks	Mark-of-the-Web Bypass
blocks	Credentials from Password Stores
blocks	Keychain
blocks	Securityd Memory
blocks	Windows Credential Manager
blocks	Password Managers
blocks	Modify Authentication Process
blocks	Domain Controller Authentication
blocks	Password Filter DLL
blocks	Pluggable Authentication Modules
blocks	Network Device Authentication
blocks	Network Provider DLL
blocks	Conditional Access Policies
blocks	Adversary-in-the-Middle
blocks	Name Resolution Poisoning and SMB Relay
blocks	ARP Cache Poisoning
blocks	DHCP Spoofing
blocks	Evil Twin
blocks	Steal or Forge Kerberos Tickets
blocks	Silver Ticket
blocks	Kerberoasting
blocks	AS-REP Roasting
blocks	Ccache Files
blocks	Inter-Process Communication
blocks	Dynamic Data Exchange
blocks	XPC Services
blocks	Archive Collected Data
blocks	Archive via Utility
blocks	Disk Wipe
blocks	Disk Content Wipe
blocks	Disk Structure Wipe
blocks	Remote Service Session Hijacking
blocks	SSH Hijacking
blocks	RDP Hijacking
blocks	Hidden Users
blocks	NTFS File Attributes
blocks	Run Virtual Instance
blocks	VBA Stomping
blocks	Email Hiding Rules
blocks	Resource Forking
blocks	Process Argument Spoofing
blocks	Data Manipulation
blocks	Stored Data Manipulation
blocks	Transmitted Data Manipulation
blocks	Runtime Data Manipulation
blocks	Phishing
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Spearphishing via Service
blocks	Exfiltration Over Web Service
blocks	Dynamic Resolution
blocks	Domain Generation Algorithms
blocks	System Services
blocks	Service Execution
blocks	Lateral Tool Transfer
blocks	Non-Standard Port
blocks	Protocol Tunneling
blocks	Encrypted Channel
blocks	Symmetric Cryptography
blocks	Asymmetric Cryptography
blocks	Hijack Execution Flow
blocks	DLL
blocks	Dylib Hijacking
blocks	Executable Installer File Permissions Weakness
blocks	Path Interception by PATH Environment Variable
blocks	Path Interception by Search Order Hijacking
blocks	Path Interception by Unquoted Path
blocks	Services File Permissions Weakness
blocks	KernelCallbackTable
blocks	AppDomainManager
blocks	Modify Cloud Compute Infrastructure
blocks	Create Snapshot
blocks	Create Cloud Instance
blocks	Delete Cloud Instance
blocks	Phishing for Information
blocks	Spearphishing Service
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Network Boundary Bridging
blocks	Network Address Translation Traversal
blocks	Modify System Image
blocks	Patch System Image
blocks	Downgrade System Image
blocks	Data from Configuration Repository
blocks	SNMP (MIB Dump)
blocks	Network Device Configuration Dump
blocks	Deploy Container
blocks	Escape to Host
blocks	Build Image on Host
blocks	Container and Resource Discovery
blocks	Debugger Evasion
blocks	Plist File Modification
blocks	Serverless Execution
blocks	Cloud Administration Command
blocks	Power Settings

Secure Controls Framework -
The Secure Controls Framework® (SCF)

"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.

The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.

Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.

The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/

Terms & Conditions

The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.