+31 artikla Kriittisten TVT-palveluntarjoajina olevien kolmansien osapuolten nimeäminen
---+31 artikla 1
---+31 artikla 2
---+31 artikla 3
---+31 artikla 4
---+31 artikla 5
---+31 artikla 6
---+31 artikla 7
---+31 artikla 8
---+31 artikla 9
---+31 artikla 10
---+31 artikla 11
---+31 artikla 12
---+31 artikla 13
|
31 artikla Kriittisten TVT-palveluntarjoajina olevien kolmansien osapuolten nimeäminen
-
1. Yleiskatsaus
| Otsikko |
Sääntely |
|
31 artikla 1
|
1. Yhteiskomitean välityksellä ja 32 artiklan 1 kohdan nojalla perustetun valvontafoorumin suosituksesta Euroopan valvontaviranomaiset
|
a)
|
nimeävät finanssiyhteisöjen kannalta kriittiset TVT-palveluntarjoajina olevat kolmannet osapuolet 2 kohdassa täsmennetyt kriteerit huomioon ottavan arvioinnin perusteella;
|
|
b)
|
nimittävät kullekin kriittiselle TVT-palveluntarjoajana olevalle kolmannelle osapuolelle päävalvojaksi Euroopan valvontaviranomaisen, joka on asetusten (EU) N:o 1093/2010, (EU) N:o 1094/2010 tai (EU) N:o 1095/2010 mukaisesti vastuussa finanssiyhteisöistä, joilla on yhdessä suurin kokonaisvarojen osuus kaikkien asianomaisen kriittisen TVT-palveluntarjoajana olevan kolmannen osapuolen palveluja käyttävien finanssiyhteisöjen yhteenlaskettujen varojen kokonaisarvosta kyseisten finanssiyhteisöjen erillisten taseiden summan perusteella.
|
|
|
31 artikla 2
|
2. Edellä 1 kohdan a alakohdassa tarkoitettu nimeäminen perustuu kaikkiin seuraaviin, TVT-palveluntarjoajana olevan kolmannen osapuolen tarjoamia TVT-palveluja koskeviin kriteereihin:
|
a)
|
järjestelmävaikutus finanssipalvelujen tarjoamisen vakauteen, jatkuvuuteen tai laatuun siinä tapauksessa, että asianomainen TVT-palveluntarjoajana oleva kolmas osapuoli epäonnistuisi laajamittaisesti palvelujensa tarjoamisessa, kun otetaan huomioon niiden finanssiyhteisöjen lukumäärä ja niiden finanssiyhteisöjen varojen kokonaisarvo, joille asianomainen TVT-palveluntarjoajana oleva kolmas osapuoli tarjoaa palveluja;
|
|
b)
|
niiden finanssiyhteisöjen systeeminen luonne tai merkitys, jotka tukeutuvat asianomaisen TVT-palveluntarjoajana olevan kolmannen osapuolen palveluihin, seuraavilla parametreilla arvioituna:
|
i)
|
niiden maailmanlaajuisten järjestelmän kannalta merkittävien laitosten (G-SII-laitokset) tai muiden järjestelmän kannalta merkittävien laitosten (O-SII-laitokset) lukumäärä, jotka tukeutuvat asianomaiseen TVT-palveluntarjoajana olevaan kolmanteen osapuoleen;
|
|
ii)
|
edellä i alakohdassa tarkoitettujen G-SII-laitosten tai O-SII-laitosten ja muiden finanssiyhteisöjen keskinäinen riippuvuus, mukaan lukien tilanteet, joissa G-SII-laitokset tai O-SII-laitokset tarjoavat finanssi-infrastruktuuripalveluja muille finanssiyhteisöille;
|
|
|
c)
|
finanssiyhteisöjen tukeutuminen asianomaisen TVT-palveluntarjoajana olevan kolmannen osapuolen tarjoamiin palveluihin sellaisten finanssiyhteisöjen kriittisten tai tärkeiden toimintojen osalta, joissa viime kädessä on mukana sama TVT-palveluntarjoajana oleva kolmas osapuoli, riippumatta siitä, tukeutuvatko finanssiyhteisöt kyseisiin palveluihin suoraan tai välillisesti, ulkoistusjärjestelyjen välityksellä;
|
|
d)
|
TVT-palveluntarjoajana olevan kolmannen osapuolen korvattavuus ottaen huomioon seuraavat parametrit:
|
i)
|
todellisten tai edes osittaisten vaihtoehtojen puute, joka johtuu yksittäisillä markkinoilla toimivien TVT-palveluntarjoajina olevien kolmansien osapuolten vähäisestä määrästä, asianomaisen TVT-palveluntarjoajana olevan kolmannen osapuolen markkinaosuudesta, asiaan liittyvästä teknisestä monimutkaisuudesta tai kehittyneisyydestä, myös suhteessa valmistajakohtaiseen teknologiaan, tai TVT-palveluntarjoajana olevan kolmannen osapuolen organisaation tai toiminnan erityispiirteistä;
|
|
ii)
|
vaikeudet, joita asianomaisen datan ja työn siirtäminen asianomaiselta TVT-palveluntarjoajana olevalta kolmannelta osapuolelta osittain tai kokonaan toiselle TVT-palveluntarjoajana olevalle kolmannelle osapuolelle aiheuttaa siirtoprosessiin liittyvien merkittävien taloudellisten kustannusten, ajan tai muiden resurssien vuoksi, tai lisääntyneen TVT-riskin tai muiden sellaisten operatiivisten riskien vuoksi, joille finanssiyhteisö voi altistua tällaisessa siirrossa.
|
|
|
|
31 artikla 3
|
3. Jos TVT-palveluntarjoajana oleva kolmas osapuoli kuuluu johonkin konserniin, 2 kohdassa tarkoitetut kriteerit on otettava huomioon koko konsernin tarjoamien TVT-palvelujen yhteydessä.
|
|
31 artikla 4
|
4. Konserniin kuuluvien kriittisten TVT-palveluntarjoajana olevien kolmansien osapuolten on nimettävä koordinointipisteeksi yksi oikeushenkilö, jotta varmistetaan riittävä edustus ja helpotetaan viestintää päävalvojan kanssa.
|
|
31 artikla 5
|
5. Päävalvojan on ilmoitettava TVT-palveluntarjoajana olevalle kolmannelle osapuolelle 1 kohdan a alakohdassa tarkoitettuun nimeämiseen johtavan arvioinnin tuloksesta. TVT-palveluntarjoajana oleva kolmas osapuoli voi kuuden viikon kuluessa ilmoituspäivästä toimittaa päävalvojalle perustellun lausunnon, joka sisältää kaikki merkitykselliset tiedot arviointia varten. Päävalvojan on tarkasteltava perusteltua lausuntoa, ja se voi pyytää lisätietoja, jotka on toimitettava 30 kalenteripäivän kuluessa tällaisen lausunnon vastaanottamisesta.
Nimettyään jonkin TVT-palveluntarjoajana olevan kolmannen osapuolen kriittiseksi Euroopan valvontaviranomaiset antavat yhteiskomitean välityksellä kyseiselle TVT-palveluntarjoajana olevalle kolmannelle osapuolelle tiedon kyseisestä nimeämisestä ja ilmoittavat päivän, josta alkaen siihen tosiasiallisesti sovelletaan valvontatoimia. Kyseinen alkamispäivä voi olla enintään yhden kuukauden kuluttua ilmoituksesta. TVT-palveluntarjoajana olevan kolmannen osapuolen on ilmoitettava kriittiseksi nimeämisestään finanssiyhteisöille, joille ne tarjoavat palveluja.
|
|
31 artikla 6
|
6. Siirretään komissiolle valta antaa viimeistään 17 päivänä heinäkuuta 2024 57 artiklan mukaisesti delegoitu säädös, jolla täydennetään tätä asetusta täsmentämällä tarkemmin tämän artiklan 2 kohdassa tarkoitetut perusteet.
|
|
31 artikla 7
|
7. Edellä 1 kohdan a alakohdassa tarkoitettua nimeämistä ei käytetä ennen kuin komissio on antanut delegoidun säädöksen 6 kohdan mukaisesti.
|
|
31 artikla 8
|
8. Edellä 1 kohdan a alakohdassa tarkoitettua nimeämistä ei sovelleta seuraaviin:
|
i)
|
finanssiyhteisöt, jotka tarjoavat TVT-palveluja muille finanssiyhteisöille;
|
|
ii)
|
TVT-palveluntarjoajana olevat kolmannet osapuolet, joihin sovelletaan Euroopan unionin toiminnasta tehdyn sopimuksen 127 artiklan 2 kohdassa tarkoitettujen tehtävien tukemiseksi perustettuja valvontakehyksiä;
|
|
iii)
|
konsernin sisäiset TVT-palveluntarjoajat;
|
|
iv)
|
TVT-palveluntarjoajana olevat kolmannet osapuolet, jotka tarjoavat TVT-palveluja yksinomaan yhdessä jäsenvaltiossa finanssiyhteisöille, jotka toimivat ainoastaan kyseisessä jäsenvaltiossa.
|
|
|
31 artikla 9
|
9. Euroopan valvontaviranomaisten on yhteiskomitean välityksellä laadittava, julkaistava ja päivitettävä vuosittain luettelo unionin tason kriittisistä TVT-palveluntarjoajina olevista kolmansista osapuolista.
|
|
31 artikla 10
|
10. Sovellettaessa 1 kohdan a alakohtaa toimivaltaisten viranomaisten on toimitettava 28 artiklan 3 kohdan kolmannessa alakohdassa tarkoitetut kertomukset 32 artiklan nojalla perustetulle valvontafoorumille vuosittain kootusti. Valvontafoorumi arvioi toimivaltaisilta viranomaisilta saatujen tietojen perusteella finanssiyhteisöjen riippuvuutta TVT-palveluntarjoajina olevista kolmansista osapuolista.
|
|
31 artikla 11
|
11. TVT-palveluntarjoajina olevat kolmannet osapuolet, joita ei ole sisällytetty 9 kohdassa tarkoitettuun luetteloon, voivat pyytää, että ne nimetään 1 kohdan a alakohdan mukaisesti kriittisiksi.
TVT-palveluntarjoajana olevan kolmannen osapuolen on ensimmäistä alakohtaa sovellettaessa toimitettava perusteltu hakemus EPV:lle, ESMAlle tai EIOPAlle, joka päättää yhteiskomitean välityksellä, nimetäänkö kyseinen TVT-palveluntarjoajana oleva kolmas osapuoli 1 kohdan a alakohdan mukaisesti kriittiseksi.
Toisessa alakohdassa tarkoitettu päätös tehdään ja annetaan tiedoksi TVT-palveluntarjoajana olevalle kolmannelle osapuolelle kuuden kuukauden kuluessa hakemuksen vastaanottamisesta.
|
|
31 artikla 12
|
12. Finanssiyhteisöt saavat käyttää kolmanteen maahan sijoittautuneen ja 1 kohdan a alakohdan mukaisesti kriittiseksi nimetyn TVT-palveluntarjoajana olevan kolmannen osapuolen palveluja ainoastaan, jos viimeksi mainittu on perustanut unioniin tytäryhtiön 12 kuukauden kuluessa nimeämisestä.
|
|
31 artikla 13
|
13. Edellä 12 kohdassa tarkoitetun kriittisen TVT-palveluntarjoajana olevan kolmannen osapuolen on ilmoitettava päävalvojalle kaikista muutoksista unioniin perustetun tytäryhtiön johdon rakenteessa.
|
,
1.1 Viittaukset
1.2 Tunnistetut vaatimukset
1.3 Liittyvät standardit
2. Tunnistetut vaatimukset
Vaatimukset
| Lähde |
Vaatimus |
3. Liittyvät standardit
Standardit
| Lähde |
Vaatimus |
|
SCF
|
Contacts With Authorities
Description
Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Documented list of law enforcement and regulatory contacts (FBI, CISA, state AG)
∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Documented contacts with FBI Cyber Division, CISA, and relevant regulators
∙ MS-ISAC or sector-specific ISAC membership
∙ Pre-established law enforcement liaisons for incident response
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Integrated Security Incident Response Team (ISIRT) with defined authority contacts
∙ CISA Cyber Liaison and FBI Cyber Division contacts
∙ Sector ISAC membership (e.g., FS-ISAC, H-ISAC, E-ISAC)
∙ Regulatory notification contact list (e.g., FTC, OCR, state regulators)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Integrated Security Incident Response Team (ISIRT) with pre-established authority relationships
∙ Formal engagement with law enforcement (FBI, USSS, CISA)
∙ Sector ISAC active membership with information sharing participation
∙ Regulatory breach notification contacts and documented procedures
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Dedicated government liaison program (FBI, CISA, NSA, sector regulators)
∙ Active ISAC membership with classified threat briefing access (where applicable)
∙ Pre-established breach notification workflows for all applicable regulators
∙ Integrated Security Incident Response Team (ISIRT) with 24/7 law enforcement contact protocols
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.
▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.
▪ Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
Level 2 Planned Tracked
Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ An implemented and operational capability exists to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Level 4 Quantitatively Controlled
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|