+Airteagal 30 Príomhfhorálacha conarthacha
---+Airteagal 30 1
---+Airteagal 30 2
---+Airteagal 30 3
---+Airteagal 30 4
---+Airteagal 30 5

Airteagal 30 Príomhfhorálacha conarthacha

-

1. Forbhreathnú

,
Airteagal 30 1

1.   Leithdháilfear cearta agus oibleagáidí an eintitis airgeadais agus an tsoláthraí seirbhísí tríú páirtí TFC go soiléir agus leagfar amach i scríbhinn iad. Áireofar sa chonradh iomlán na comhaontuithe ar leibhéal seirbhísí agus déanfar é a dhoiciméadú i ndoiciméad scríofa amháin a bheidh ar fáil do na páirtithe ar pháipéar nó i ndoiciméad ag a bhfuil formáid eile in-íoslódáilte marthanach inléite.
Airteagal 30 2

2.   Beidh na gnéithe seo a leanas ar a laghad sna socruithe conarthacha maidir le húsáid seirbhísí TFC:

(a)

tuairisc shoiléir iomlán ar gach feidhm agus seirbhís TFC atá le soláthar ag an soláthraí seirbhísí TFC tríú páirtí, lena dtabharfar le fios an gceadaítear nó nach gceadaítear fochonraitheoireacht ar sheirbhísí TFC lena dtacaítear feidhm chriticiúil nó thábhachtach, nó codanna ábhartha di, agus nuair is é sin an cás, na coinníollacha is infheidhme maidir le fochonrú den sórt sin;

(b)

na suíomhanna, is é sin na réigiúin nó na tíortha, mar a bhfuil na feidhmeanna conarthacha nó fochonarthacha agus na seirbhísí TFC conarthacha nó fochonarthacha le soláthar agus mar a bhfuil sonraí le próiseáil, lena n-áirítear an suíomh stórála, agus an ceanglas go dtabharfaidh an soláthraí seirbhísí TFC tríú páirtí fógra don eintiteas airgeadais roimh ré má bheartaíonn sé an suíomh nó na suíomhanna sin a athrú;

(c)

Forálacha maidir le hinfhaighteacht, barántúlacht, sláine agus rúndacht i ndáil le cosaint sonraí, lena n-áirítear sonraí pearsanta;

(d)

forálacha maidir le rochtain, athshlánú agus tabhairt ar ais sonraí pearsanta agus sonraí neamhphearsanta a phróiseálann an t-eintiteas airgeadais, a áirithiú i bhformáid is inrochtana go héasca i gcás dhócmhainneacht, réitigh nó scor oibríochtaí gnó an tsoláthraí seirbhísí TFC tríú páirtí, nó i gcás fhoirceannadh na socruithe conarthacha;

(e)

tuairiscí ar leibhéal seirbhísí, lena n-áirítear nuashonruithe agus athbhreithnithe orthu sin;

(f)

an oibleagáid atá ar sholáthraí seirbhísí TFC tríú páirtí cúnamh a sholáthar don eintiteas airgeadais gan aon chostas breise, nó ar chostas a chinntear ex ante, i gcás ina dtarlaíonn teagmhas TFC a bhaineann le seirbhís TFC a sholáthraítear don eintiteas airgeadais;

(g)

an oibleagáid atá ar sholáthraí seirbhísí TFC tríú páirtí comhoibriú go hiomlán le húdaráis inniúla agus le húdaráis réitigh an eintitis airgeadais, lena n-áirítear daoine arna gceapadh acu;

(h)

cearta foirceanta agus íostréimhse fógraí ghaolmhar chun an conradh a fhoirceannadh, i gcomhréir le hionchais na n-údarás inniúil agus na n-údarás réitigh;

(i)

na coinníollacha maidir le rannpháirtíocht soláthraithe seirbhísí TFC tríú páirtí i gcláir feasachta slándála TFC na n-eintiteas airgeadais agus in oiliúint ar athléimneacht dhigiteach oibríochtúil i gcomhréir le hAirteagal 13(6).
Airteagal 30 3

3.   Áireofar sna socruithe conarthacha maidir le seirbhísí TFC lena dtacaítear le feidhmeanna criticiúla nó tábhachtacha a úsáid, de bhreis ar na gnéithe dá dtagraítear i mír 2, iad seo a leanas ar a laghad:

(a)

tuairiscí iomlána ar leibhéal seirbhíse, lena n-áirítear nuashonruithe agus athbhreithnithe orthu sin, agus spriocanna feidhmíochta beachta cainníochtúla agus cáilíochtúla laistigh de na leibhéil seirbhíse chomhaontaithe ag gabháil leo chun gur féidir leis an eintiteas airgeadais faireachán éifeachtach a dhéanamh ar sheirbhísí TFC agus chun gur féidir gníomhaíochtaí ceartaitheacha iomchuí a dhéanamh gan moill mhíchuí i gcás nach gcomhlíonfar leibhéil seirbhíse chomhaontaithe;

(b)

tréimhsí fógra agus oibleagáidí tuairiscithe an tsoláthraí seirbhísí TFC tríú páirtí don eintiteas airgeadais, lena n-áirítear fógra faoi aon fhorbairt a d’fhéadfadh tionchar ábhartha a imirt ar chumas an tsoláthraí seirbhísí TFC tríú páirtí na seirbhísí TFC lena dtacaítear le feidhmeanna criticiúla nó tábhachtacha a sholáthar go héifeachtach i gcomhréir le leibhéil seirbhíse chomhaontaithe;

(c)

ceanglais ar an soláthraí seirbhísí TFC tríú páirtí pleananna teagmhasacha gnó a chur chun feidhme agus a thástáil agus bearta, uirlisí agus beartais slándála TFC a bheith i bhfeidhm aige lena soláthraítear leibhéal iomchuí slándála lena bhféadfadh an t-eintiteas airgeadais seirbhísí a sholáthar i gcomhréir lena chreat rialála;

(d)

oibleagáid an tsoláthraí seirbhísí TFC tríú páirtí a bheith rannpháirteach agus comhoibriú go hiomlán in TLPT an eintitis airgeadais dá dtagraítear in Airteagail 26 agus 27;

(e)

an ceart chun faireachán a dhéanamh ar bhonn leanúnach ar fheidhmíocht an tsoláthraí seirbhísí TFC tríú páirtí, a mbíonn an méid a leanas i gceist:

(i)

cearta rochtana, cigireachta agus iniúchóireachta gan srian a bheith ag an eintiteas airgeadais nó ag tríú páirtí arna cheapadh, agus ag an údarás inniúil, agus an ceart chun cóipeanna de dhoiciméadacht ábhartha a dhéanamh ar an láthair má tá siad ríthábhachtach d’oibríochtaí an tsoláthraí seirbhísí TFC tríú páirtí, ar ceart é nach mbeidh a fheidhmiú éifeachtach faoi bhac ná faoi theorainn socruithe conarthacha eile ná faoi theorainn bheartas cur chun feidhme eile;

(ii)

an ceart chun teacht ar chomhaontú maidir le leibhéil dearbhaithe mhalartacha má dhéantar difear do chearta cliant eile;

(iii)

an oibleagáid ar an soláthraí seirbhísí TFC tríú páirtí comhoibriú go hiomlán le linn na gcigireachtaí agus na n-iniúchtaí ar an láthair arna ndéanamh ag na húdaráis inniúla, ag an bPríomh-Fhormhaoirseoir, ag eintiteas airgeadais nó ag tríú páirtí ceaptha; agus

(iv)

an oibleagáid sonraí a sholáthar maidir leis an raon feidhme, na nósanna imeachta atá le leanúint agus minicíocht na gcigireachtaí agus na n-iniúchtaí sin;

(f)

straitéisí scoir, go háirithe idirthréimhse leordhóthanach éigeantach a bhunú:

(i)

leanfaidh an soláthraí seirbhísí TFC tríú páirtí de na feidhmeanna nó seirbhísí TFC faoi seach a sholáthar lena linn d’fhonn an riosca suaitheadh ag an eintiteas airgeadais a laghdú nó d’fhonn a réiteach agus a athstruchtúrú éifeachtach a áirithiú;

(ii)

rud lena bhfágfaidh go mbeidh an t-eintiteas airgeadais in ann aistriú chuig soláthraí seirbhísí TFC tríú páirtí eile nó athrú chuig réitigh inmheánacha i gcomhréir le castacht na seirbhíse arna soláthar.

Féadfaidh an soláthraí seirbhísí TFC tríú páirtí agus an t-eintiteas ar micrifhiontar é a chomhaontú, de mhaolú ar phointe (e), go bhféadfar cearta rochtana, cigireachta agus iniúchóireachta an eintitis airgeadais a tharmligean chuig tríú páirtí neamhspleách, arna cheapadh ag an soláthraí seirbhísí TFC tríú páirtí, agus go bhféadfaidh an t-eintiteas airgeadais faisnéis agus dearbhú maidir le feidhmíocht an tsoláthraí seirbhísí TFC tríú páirtí a iarraidh ar an tríú páirtí am ar bith.
Airteagal 30 4

4.   Agus idirbheartaíocht á déanamh i leith socruithe conarthacha, measfaidh eintitis airgeadais agus soláthraithe seirbhísí TFC tríú páirtí úsáid a bhaint as clásail chonarthacha chaighdeánacha a fhorbróidh údaráis phoiblí le haghaidh seirbhísí sonracha.
Airteagal 30 5

5.   Déanfaidh ÚMEnna, tríd an gComhchoiste, dréachtchaighdeáin theicniúla rialála a fhorbairt chun sonrú breise a dhéanamh ar na gnéithe dá dtagraítear i mír 2, pointe (a), is gá d’eintiteas airgeadais a chinneadh agus a mheasúnú i gcás seirbhísí TFC lena dtacaítearle feidhmeanna criticiúla nó tábhachtacha a bheith á gcur amach ar fochonradh.

Agus na dréachtchaighdeáin theicniúla rialála sin á bhforbairt acu, cuirfidh ÚMEnna san áireamh méid agus próifíl riosca fhoriomlán an eintitis airgeadais, cineál, scála agus castacht a sheirbhísí, a ghníomhaíochtaí agus a oibríochtaí.

Cuirfidh ÚMEnna na dréachtchaighdeáin theicniúla rialála sin faoi bhráid an Choimisiúin faoin 17 Iúil 2024.

Tarmligtear an chumhacht chuig an gCoimisiún an Rialachán seo a fhorlíonadh trí na caighdeáin theicniúla rialála dá dtagraítear sa chéad fhomhír a ghlacadh i gcomhréir le hAirteagail 10 go 14 de Rialacháin (AE) Uimh. 1093/2010, (AE) Uimh. 1094/2010 agus (AE) Uimh. 1095/2010.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
SCF Third-Party Management

Description

Mechanisms exist to facilitate the implementation of third-party management controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Supply Chain Risk Management (SCRM)

Description

Mechanisms exist to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF Third-Party Contract Requirements

Description

Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Procurement practices contractually require ESP to follow secure engineering practices as part of a broader Cybersecurity Supply Chain Risk Management (C-SCRM) initiative.
▪ A formal agreement exists between the organization and applicable third-parties that includes a Non-Disclosure Agreement (NDA) addressing shared sensitive data.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its TAASD.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Review of Third-Party Services

Description

Mechanisms exist to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to monitor, regularly review and assess External Service Providers (ESPs) for compliance with established contractual requirements for security, compliance and resilience controls.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Third-Party Management

Description

Mechanisms exist to facilitate the implementation of third-party management controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Supply Chain Risk Management (SCRM)

Description

Mechanisms exist to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF Third-Party Contract Requirements

Description

Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Procurement practices contractually require ESP to follow secure engineering practices as part of a broader Cybersecurity Supply Chain Risk Management (C-SCRM) initiative.
▪ A formal agreement exists between the organization and applicable third-parties that includes a Non-Disclosure Agreement (NDA) addressing shared sensitive data.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its TAASD.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Third-Party Management

Description

Mechanisms exist to facilitate the implementation of third-party management controls.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Supply Chain Risk Management (SCRM)

Description

Mechanisms exist to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to:
(1) Evaluate security risks and threats associated with Technology Assets, Applications and/or Services (TAAS) supply chains; and
(2) Take appropriate remediation actions to minimize the organization's exposure to those risks and threats, as necessary.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF Third-Party Contract Requirements

Description

Mechanisms exist to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its Technology Assets, Applications, Services and/or Data (TAASD).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Data Protection Impact Assessment (DPIA)
∙ Third-party contract requirements for cybersecurity controls
∙ Non-Disclosure Agreements (NDAs)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Procurement practices contractually require ESP to follow secure engineering practices as part of a broader Cybersecurity Supply Chain Risk Management (C-SCRM) initiative.
▪ A formal agreement exists between the organization and applicable third-parties that includes a Non-Disclosure Agreement (NDA) addressing shared sensitive data.

Level 3 Well Defined

Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to require contractual requirements for applicable security, compliance and resilience requirements with third-parties, reflecting the organization's needs to protect its TAASD.

Level 4 Quantitatively Controlled

Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.