+Airteagal 26 Oibleagáidí úsáideoirí gairmiúla na gcóras intleachta saorga ardriosca
---+Airteagal 26 1.
---+Airteagal 26 2.
---+Airteagal 26 3.
---+Airteagal 26 4.
---+Airteagal 26 5.
---+Airteagal 26 6.
---+Airteagal 26 7.
---+Airteagal 26 8.
---+Airteagal 26 9.
---+Airteagal 26 10.
---+Airteagal 26 11.
---+Airteagal 26 12.

Airteagal 26 Oibleagáidí úsáideoirí gairmiúla na gcóras intleachta saorga ardriosca

-

1. Forbhreathnú

,
Airteagal 26 1.
Déanfaidh úsáideoirí gairmiúla córas intleachta saorga ardriosca bearta teicniúla agus eagraíochtúla iomchuí chun a áirithiú go n-úsáidfidh siad na córais sin i gcomhréir leis na treoracha úsáide a ghabhann leo, de bhun mhíreanna 3 agus 6.
Airteagal 26 2.
Sannfaidh úsáideoirí gairmiúla maoirseacht dhaonna do dhaoine nádúrtha a bhfuil an inniúlacht, an oiliúint agus an t-údarás is gá, chomh maith leis an tacaíocht is gá, acu.
Airteagal 26 3.
Tá na hoibleagáidí a leagtar amach i míreanna 1 agus 2 gan dochar d’oibleagáidí eile úsáideoirí gairmiúla faoi dhlí an Aontais nó faoin dlí náisiúnta ná do shaoirse an úsáideora ghairmiúil a chuid acmhainní féin agus a ghníomhaíochtaí féin a eagrú chun na bearta formhaoirseachta daonna arna gcur in iúl ag an soláthraí a chur chun feidhme.
Airteagal 26 4.
Gan dochar do mhíreanna 1 agus 2, sa mhéid go bhfeidhmíonn an t-úsáideoir gairmiúil smacht ar na sonraí ionchuir, áiritheoidh an t-úsáideoir gairmiúil sin go mbeidh na sonraí ionchuir ábhartha agus ionadaíoch go leordhóthanach i bhfianaise na críche atá beartaithe don chóras intleachta saorga ardriosca.
Airteagal 26 5.
Déanfaidh úsáideoirí gairmiúla faireachán ar oibriú an chórais intleachta saorga ardriosca ar bhonn na dtreoracha úsáide agus, i gcás inarb ábhartha, cuirfidh siad na soláthraithe ar an eolas i gcomhréir le hAirteagal 72. I gcás ina mbeidh cúis ag úsáideoirí gairmiúla a mheas go bhféadfadh riosca de réir bhrí Airteagal 79(1) a bheith ag baint leis an gcóras intleachta saorga mar thoradh ar úsáid an chórais intleachta saorga ardriosca i gcomhréir leis na treoracha, cuirfidh siad an soláthraí nó an dáileoir agus an t-údarás ábhartha faireachais margaidh ar an eolas gan moill mhíchuí, agus cuirfidh siad úsáid an chórais sin ar fionraí. I gcás ina sainaithníonn úsáideoirí gairmiúla teagmhas tromchúiseach, láithreach bonn, cuirfidh siad an soláthraí ar dtús agus ansin an t-allmhaireoir nó an dáileoir agus na húdaráis ábhartha faireachais margaidh ar an eolas faoin teagmhas sin. Mura féidir leis an úsáideoir gairmiúil teagmháil a dhéanamh leis an soláthraí, beidh feidhm ag Airteagal 73 mutatis mutandis. Ní chumhdófar leis an oibleagáid sin sonraí oibríochtúla íogaire úsáideoirí gairmiúla córas intleachta saorga ar údaráis forfheidhmithe dlí iad.

I gcás úsáideoirí gairmiúla ar institiúidí airgeadais iad atá faoi réir ceanglais maidir lena rialachas, socruithe nó próisis inmheánacha faoi dhlí sheirbhísí airgeadais an Aontais, measfar go gcomhlíontar an oibleagáid faireacháin a leagtar amach sa chéad fhomhír trí na rialacha maidir le socruithe, próisis agus sásraí an rialachais inmheánaigh de bhun an dlí seirbhísí airgeadais ábhartha a chomhlíonadh.
Airteagal 26 6.
Coimeádfaidh úsáideoirí gairmiúla córas intleachta saorga ardriosca na logaí a ghintear go huathoibríoch leis an gcóras intleachta saorga ardriosca sin a mhéid atá na logaí sin faoina rialú, ar feadh tréimhse is iomchuí don chríoch atá beartaithe don chóras intleachta saorga ardriosca, tréimhse 6 mhí ar a laghad, mura bhforáiltear a mhalairt i ndlí an Aontais nó sa dlí náisiúnta is infheidhme, go háirithe i ndlí an Aontais maidir le cosaint sonraí pearsanta.

Maidir le húsáideoirí gairmiúla ar institiúidí airgeadais iad atá faoi réir ceanglais maidir lena rialachas, socruithe nó próisis inmheánacha faoi dhlí sheirbhísí airgeadais an Aontais, coinneoidh siad na logaí mar chuid den doiciméadacht a choimeádtar de bhun dhlí sheirbhísí airgeadais ábhartha an Aontais.
Airteagal 26 7.
Sula gcuirfear córas intleachta saorga ardriosca i mbun seirbhíse nó sula n-úsáidfear é san ionad oibre, cuirfidh úsáideoirí gairmiúla ar fostóirí iad in iúl d’ionadaithe na n-oibrithe agus do na hoibrithe lena mbaineann go mbeidh siad faoi réir úsáid an chórais intleachta saorga ardriosca. Cuirfear an fhaisnéis sin ar fáil, i gcás inarb infheidhme, i gcomhréir leis na rialacha agus na nósanna imeachta a leagtar síos i ndlí agus cleachtas an Aontais agus i ndlí agus cleachtas náisiúnta maidir le faisnéis a bhaineann le hoibrithe agus a n-ionadaithe.
Airteagal 26 8.
Úsáideoirí gairmiúla córas intleachta saorga ardriosca ar údaráis phoiblí nó institiúidí, comhlachtaí, oifigí nó gníomhaireachtaí an Aontais iad, comhlíonfaidh siad na hoibleagáidí clárúcháin dá dtagraítear in Airteagal 49. I gcás ina bhfaigheann na húsáideoirí gairmiúla sin amach nár cláraíodh an córas intleachta saorga ardriosca a bheartaíonn siad a úsáid i mbunachar sonraí an Aontais dá dtagraítear in Airteagal 71, ní úsáidfidh siad an córas sin agus cuirfidh siad an soláthraí nó an dáileoir ar an eolas.
Airteagal 26 9.
I gcás inarb infheidhme, bainfidh úsáideoirí gairmiúla córas intleachta saorga ardriosca úsáid as an bhfaisnéis arna soláthar faoi Airteagal 13 den Rialachán seo chun a n-oibleagáid measúnú tionchair ar chosaint sonraí a dhéanamh faoi Airteagal 35 de Rialachán (AE) 2016/679 nó Airteagal 27 de Threoir (AE) 2016/680 a chomhlíonadh.
Airteagal 26 10.
Gan dochar do Threoir (AE) 2016/680, faoi chuimsiú imscrúdú ar chuardach spriocdhírithe ar dhuine atá faoi amhras nó atá ciontaithe i gcion coiriúil a dhéanamh, iarrfaidh úsáideoir gairmiúil córais intleachta saorga ardriosca le haghaidh córas cian-sainaitheanta bithmhéadraí iar-aimseartha údarú, ex ante, nó gan moill mhíchuí agus tráth nach déanaí ná 48 uair an chloig, ó údarás breithiúnach nó údarás riaracháin a bhfuil a chinneadh ceangailteach agus faoi réir athbhreithniú breithiúnach, chun an córas sin a úsáid, ach amháin i gcás ina n-úsáidtear é chun duine a d’fhéadfadh a bheith faoi amhras a shainaithint den chéad uair bunaithe ar fhíorais oibiachtúla infhíoraithe a bhaineann go díreach leis an gcion. Beidh gach úsáid teoranta don mhéid atá fíor-riachtanach chun imscrúdú a dhéanamh ar chion coiriúil sonrach.

Má dhiúltaítear don údarú a iarrtar de bhun na chéad fomhíre, cuirfear deireadh, le héifeacht láithreach, le húsáid an chórais cian-sainaitheanta bithmhéadraí iar-aimseartha atá nasctha leis an údarú iarrtha sin agus scriosfar na sonraí pearsanta atá nasctha le húsáid an chórais intleachta saorga ardriosca ar iarradh an t-údarú ina leith.

I gcás ar bith, ní úsáidfear córas intleachta saorga ardriosca mar sin le haghaidh córas cian-sainaitheanta iar-aimseartha chun críocha fhorfheidhmiú an dlí ar bhealach nach bhfuil spriocdhírithe, gan aon nasc le cion coiriúil, le himeacht coiriúil, le fíorbhagairt atá ann nó fíorbhagairt intuartha maidir le cion coiriúil, ná le duine sonrach atá ar iarraidh a chuardach. Áiritheofar nach bhféadfaidh na húdaráis forfheidhmithe dlí aon chinneadh a dhéanamh a mbeidh éifeacht dhíobhálach dhlíthiúil aige ar dhuine bunaithe ar aschur na gcóras cian-sainaitheanta bithmhéadraí iar-aimseartha sin.

Tá an mhír seo gan dochar d’Airteagal 9 de Rialachán (AE) 2016/679 agus d’Airteagal 10 de Threoir (AE) 2016/680 i ndáil le sonraí bithmhéadracha a phróiseáil.

Gan beann ar chuspóir na húsáide ná cuspóir an úsáideora ghairmiúil, déanfar gach úsáid a bhaintear as na córais intleachta saorga ardriosca sin a dhoiciméadú sa chomhad póilíneachta ábhartha agus cuirfear ar fáil í don údarás ábhartha faireachais margaidh agus don údarás náisiúnta um chosaint sonraí arna iarraidh sin, cé is moite de nochtadh sonraí oibríochtúla íogaire a bhaineann le forfheidhmiú an dlí. Beidh an fhomhír seo gan dochar do na cumhachtaí a thugtar d’údaráis mhaoirseachta le Treoir (AE) 2016/680.

Cuirfidh úsáideoirí gairmiúla tuarascálacha bliantúla faoi bhráid na n-údarás ábhartha faireachais margaidh agus na n-údarás náisiúnta um chosaint sonraí maidir leis an úsáid a bhaineann siad as córas cian-sainaitheanta bithmhéadraí iar-aimseartha, cé is moite de nochtadh sonraí oibríochtúla íogaire a bhaineann le forfheidhmiú an dlí a nochtadh. Féadfar na tuarascálacha a chomhiomlánú chun níos mó ná imscaradh amháin a chumhdach.

Féadfaidh na Ballstáit, i gcomhréir le dlí an Aontais, dlíthe níos sriantaí a thabhairt isteach maidir le húsáid córas cian-sainaitheanta bithmhéadraí iar-aimseartha.
Airteagal 26 11.
Maidir le húsáideoirí gairmiúla na gcóras intleachta saorga ardriosca dá dtagraítear in Iarscríbhinn III a dhéanann cinntí nó a chabhraíonn le cinntí a dhéanamh maidir le daoine nádúrtha, déanfaidh siad, gan dochar d’Airteagal 50 den Rialachán seo, na daoine nádúrtha a chur ar an eolas go bhfuil siad faoi réir úsáid an chórais intleachta saorga ardriosca. I gcás córas intleachta saorga ardriosca a úsáidtear chun críocha fhorfheidhmiú an dlí, beidh feidhm ag Airteagal 13 de Threoir (AE) 2016/680.
Airteagal 26 12.
Comhoibreoidh úsáideoirí gairmiúla leis na húdaráis inniúla ábhartha maidir le haon ghníomhaíocht a dhéanfaidh na húdaráis sin i ndáil leis an gcóras intleachta saorga ardriosca chun an Rialachán seo a chur chun feidhme.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
SCF AI & Autonomous Technologies Deployment

Description

Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Deploy AI tools only for documented, approved purposes

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI deployment approval process
∙ Document intended use and technical measures

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI deployment policy
∙ Technical and organizational measures for AI deployment

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI deployment governance program
∙ Formal approval workflows
∙ Post-deployment monitoring

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI deployment governance framework
∙ Automated deployment controls
∙ Continuous monitoring
∙ Regulatory compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions for use.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Oversight Functions Competency

Description

Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Train AI system operators on oversight responsibilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Training program for personnel overseeing AI systems

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI oversight training program
∙ Competency requirements for AI oversight roles

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI training and certification program for oversight personnel

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI training and certification program
∙ Role-based AI competency framework
∙ Continuous learning program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Data Relevance

Description

Mechanisms exist to ensure the input to Artificial Intelligence (AI) and Autonomous Technologies (AAT) is relevant to the intended purpose of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Validate that inputs to AI tools are relevant before submitting

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Policy requiring relevance checking of AI inputs

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI input validation policy
∙ Input relevance criteria documentation

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Input validation controls for AI systems
∙ Automated input filtering

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI input governance framework
∙ Automated input validation and filtering
∙ Data quality controls for AI pipelines

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the input to AAT is relevant to the intended purpose of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Irregularity Reporting

Description

Mechanisms exist to ensure serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Report serious AI incidents and irregularities to management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Incident reporting procedure for AI irregularities

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI incident and irregularity reporting policy
∙ Regulatory reporting contacts

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI incident response program with regulatory reporting integration

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI incident management platform
∙ Automated regulatory notification
∙ Legal and compliance integration

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure serious incidents and/or irregularities associated with the deployment of AAT are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Use Notification To Employees

Description

Mechanisms exist to ensure employees, including workers' representatives, are informed about Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments, prior to the use of the AAT in a production environment.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Inform employees of AI tools being used in their work

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Policy requiring employee notification of AI tools affecting their work

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal employee notification policy for AI deployments
∙ Communication procedures

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI transparency program for employees
∙ Works council/union notification as required

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI employee transparency framework
∙ Formal notification procedures
∙ Labor law compliance tracking

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure employees, including workers' representatives, are informed about AAT deployments, prior to the use of the AAT in a production environment.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Use Notification To Users

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Inform users when AI is making or assisting decisions affecting them

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ User notification policy for AI-assisted decisions

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal user notification policy and procedures for AI decision support

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI user transparency program
∙ Automated user notifications for AI decisions

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI user transparency framework
∙ Automated disclosure mechanisms
∙ Regulatory compliance (EU AI Act, GDPR)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Event Logging

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Enable basic logging on AI/ML systems

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Configure event logging on AI systems
∙ Define log retention periods

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI event logging policy
∙ Centralized log collection

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ SIEM integration for AI system logs
∙ Defined logging standards for AI platforms

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise SIEM platform
∙ Standardized AI event logging schema
∙ Automated alerting for anomalous AI events

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Registration

Description

Mechanisms exist to maintain a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing body, as required by statutory or regulatory requirements.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Determine whether any AI use requires registration (e.g., EU AI Act high-risk systems)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Track AI registration obligations by jurisdiction in compliance checklist

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Register high-risk AI systems with relevant authorities as required

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI registration compliance program
∙ Track registration requirements by jurisdiction

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI regulatory compliance platform
∙ Automated registration tracking
∙ EU AI Act database registration compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to maintain a current registration for AAT with the appropriate governing body, as required by statutory or regulatory requirements.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Data Protection Impact Assessment (DPIA)

Description

Mechanisms exist to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.