+Time To Remediate / Benchmarks For Corrective Action
|
Time To Remediate / Benchmarks For Corrective Action
Description
Mechanisms exist to track the effectiveness of remediation operations through metrics reporting.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Define and track time-to-remediate goals by severity
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Vulnerability remediation SLAs by severity level
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal remediation SLA policy with benchmark tracking
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Enterprise remediation SLA management and benchmarking program
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise vulnerability management platform with SLA tracking and reporting (e.g., Tenable.io, Qualys)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners. ▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution and vulnerability scanning solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to track the effectiveness of remediation operations through metrics reporting.
Level 4 Quantitatively Controlled
Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes. ▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
1. Forbhreathnú
1.1 Tagairtí
1.2 Ceanglais aitheanta
1.3 Rialacháin ghaolmhara
2. Ceanglais aitheanta
Ceanglais
| Foinse |
Ceanglas |
3. Rialacháin ghaolmhara
Rialacháin
| Foinse |
Rialáil |
|
EULAW
|
Airteagal 26 1
1. Déanfaidh eintitis airgeadais, nach eintitis dá dtagraítear in Airteagal 16(1), an chéád fhomhír, agus nach micrifhiontair iad, a shainaithnítear i gcomhréir le mír 8, an triú fomhír, den Airteagal seo, ardtástáil gach 3 bliana ar a laghad trí bhíthin TLPT. Bunaithe ar phróifíl riosca an eintitis airgeadais agus imthosca oibríochtúla á gcur san áireamh, féadfaidh an t-údarás inniúil, i gcás inar gá, a iarraidh ar an eintiteas airgeadais an mhinicíocht sin a laghdú nó a mhéadú.
|
|
EULAW
|
Airteagal 26 2
2. Cumhdófar le gach tástáil treáite bunaithe ar bhagairtí roinnt feidhmeanna agus seirbhísí criticiúla nó tábhachtacha de chuid eintitis airgeadais nó iad uile, agus déanfar an tástáil sin ar chórais táirgeachta bheo a thacaíonn leis na feidhmeanna sin.
Sainaithneoidh eintitis airgeadais gach bunchóras, bunphróiseas agus bunteicneolaíocht ábhartha TFC lena dtacaítear le feidhmeanna criticiúla nó tábhachtacha agus le seirbhísí TFC ábhartha uile, lena n-áirítear iad sin lena dtacaítear leis na feidhmeanna criticiúla nó tábhachtacha a seachfhoinsíodh chuig soláthraithe seirbhísí TFC tríú páirtí nó a cuireadh faoi cheangal conartha do sholáthraithe seirbhísí TFC tríú páirtí.
Déanfaidh eintitis airgeadais measúnú ar na feidhmeanna criticiúla is gá a bheith cumhdaithe ag TLPT. Cinnfear le toradh an mheasúnaithe sin raon feidhme beacht TLPT agus déanfaidh na húdaráis inniúla é a bhailíochtú.
|
|
EULAW
|
Airteagal 26 3
3. I gcás ina n-áireofar soláthraithe seirbhísí TFC tríú páirtí i raon feidhme TLPT, déanfaidh an t-eintiteas airgeadais na bearta agus na coimircí is gá chun rannpháirtíocht na soláthraithe seirbhísí TFC tríú páirtí sin in TLPT a áirithiú agus coinneoidh sé an fhreagracht iomlán i gcónaí as comhlíonadh an Rialacháin seo a áirithiú.
|
|
EULAW
|
Airteagal 26 4
4. Gan dochar do mhír 2, an chéad agus an dara fomhír, i gcás ina mbeifear ag súil go réasúnach leis go mbeidh drochthionchar ag rannpháirtíocht soláthraithe seirbhísí TFC tríú páirtí in TLPT, dá dtagraítear i mír 3, ar cháilíocht nó slándáil na seirbhísí a sholáthraíonn soláthraí seirbhísí TFC tríú páirtí do chustaiméirí ar eintitis iad nach dtagann faoi raon feidhme an Rialacháin seo, nó ar rúndacht na sonraí a bhaineann le seirbhísí den sórt sin, féadfaidh an t-eintiteas airgeadais agus soláthraí seirbhísí TFC tríú páirtí a chomhaontú i scríbhinn go ndéanfaidh soláthraí seirbhísí TFC tríú páirtí socruithe conarthacha go díreach le tástálaí seachtrach, chun TLPT comhchruinnithe a dhéanamh, faoi stiúir eintiteas airgeadais ainmnithe amháin, ina bhfuil roinnt eintiteas airgeadais páirteach (tástáil chomhthiomsaithe) a sholáthraíonn soláthraí seirbhísí TFC tríú páirtí seirbhísí TFC dóibh.
Cumhdófar leis an tástáil chomhthiomsaithe sin an raon ábhartha seirbhísí TFC lena dtacaítear leis na feidhmeanna criticiúla nó tábhachtacha atá curtha faoi cheangal conartha do sholáthraí seirbhísí TFC tríú páirtí faoi seach ag na heintitis airgeadais. Measfar an tástáil chomhthiomsaithe a bheith ina TLPT arna déanamh ag na heintitis airgeadais atá rannpháirteach sa tástáil chomhthiomsaithe.
Déanfar líon na n-eintiteas airgeadais atá rannpháirteach sa tástáil chomhthiomsaithe a chalabrú go cuí agus castacht agus cineálacha na seirbhísí lena mbaineann á gcur san áireamh.
|
|
EULAW
|
Airteagal 26 5
5. Déanfaidh eintitis airgeadais, i gcomhar le soláthraithe seirbhísí TFC tríú páirtí agus páirtithe eile lena mbaineann, lena n-áirítear na tástálaithe ach gan na húdaráis inniúla a chur san áireamh, rialuithe éifeachtacha bainistíochta riosca a chur i bhfeidhm chun maolú a dhéanamh ar na rioscaí a bhaineann le haon tionchar a d’fhéadfadh a bheith ar shonraí, damáiste do shócmhainní, agus suaitheadh ar fheidhmeanna, seirbhísí nó oibríochtaí criticiúla nó tábhachtacha ag an eintiteas airgeadais féin, a chontrapháirtithe nó ar an earnáil airgeadais.
|
|
EULAW
|
Airteagal 26 6
6. Ag deireadh na tástála, tar éis tuarascálacha agus pleananna feabhsúcháin a bheith comhaontaithe, cuirfidh an t-eintiteas airgeadais agus, i gcás inarb infheidhme, na tástálaithe seachtracha achoimre ar fáil don údarás, arna ainmniú i gcomhréir le mír 9 nó mír 10, ar na torthaí ábhartha, ar na pleananna feabhsúcháin agus ar an doiciméadacht lena léirítear go ndearnadh TLPT i gcomhréir leis na ceanglais.
|
|
EULAW
|
Airteagal 26 7
7. Tabharfaidh na húdaráis fianú d’eintitis airgeadais lena ndeimhneofar go ndearnadh an tástáil i gcomhréir leis na ceanglais mar a léirítear sa doiciméadacht chun go bhféadfar aitheantas frithpháirteach a thabhairt do thástálacha treáite bunaithe ar bhagairtí idir údaráis inniúla. Tabharfaidh an t-eintiteas airgeadais fógra don údarás inniúil ábhartha maidir leis an bhfianú, an achoimre ar na torthaí ábhartha agus na pleananna feabhsúcháin.
Gan dochar d’fhianú den sórt sin, leanfaidh eintitis airgeadais de bheith freagrach go hiomlán i gcónaí as tionchar na dtástálacha dá dtagraítear i mír 4.
|
|
EULAW
|
Airteagal 26 8
8. Déanfaidh eintitis airgeadais tástálaithe a chur faoi chonradh chun TLPT a dhéanamh i gcomhréir le hAirteagal 27. I gcás ina n-úsáideann eintitis airgeadais tástálaithe inmheánacha chun TLPT a dhéanamh, cuirfidh siad tástálaithe seachtrach faoi chonradh i ngach tríú tástáil.
Institiúidí creidmheasa a aicmítear mar eintitis shuntasacha i gcomhréir le hAirteagal 6(4) de Rialachán (AE) Uimh. 1024/2013, ní úsáidfidh siad ach tástálaithe seachtracha i gcomhréir le hAirteagal 27(1), pointí (a) go (e).
Sainaithneoidh na húdaráis inniúla eintitis airgeadais a gceanglaítear orthu TLPT a dhéanamh agus na critéir a leagtar amach in Airteagal 4(2) á gcur san áireamh, bunaithe ar mheasúnú ar an méid seo a leanas:
|
(a)
|
tosca a bhaineann le tionchar, go háirithe a mhéid a bhíonn tionchar ag na seirbhísí arna soláthar agus ag na gníomhaíochtaí a dhéanann an t-eintiteas airgeadais ar an earnáil airgeadais;
|
|
(b)
|
ábhair imní fhéideartha maidir le cobhsaíocht airgeadais, lena n-áirítear saintréithe sistéamacha an eintitis airgeadais ar leibhéal náisiúnta nó leibhéal an Aontais, de réir mar is infheidhme;
|
|
(c)
|
próifíl riosca shonrach TFC, leibhéal sonrach aibíochta TFC an eintitis airgeadais nó gnéithe sonracha teicneolaíochta atá i gceist.
|
|
|
EULAW
|
Airteagal 10 Bainistíocht leochaileachta agus bainistiú paistí
|
Saincheisteanna nasctha
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.
|