+Time To Remediate / Benchmarks For Corrective Action
|
Time To Remediate / Benchmarks For Corrective Action
Description
Mechanisms exist to track the effectiveness of remediation operations through metrics reporting.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Define and track time-to-remediate goals by severity
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Vulnerability remediation SLAs by severity level
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal remediation SLA policy with benchmark tracking
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Enterprise remediation SLA management and benchmarking program
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise vulnerability management platform with SLA tracking and reporting (e.g., Tenable.io, Qualys)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Vulnerability & Patch Management (VPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Vulnerability management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Vulnerability management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Vulnerability & Patch Management (VPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with VPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with VPM domain capabilities are well-documented and kept current by process owners.
▪ A vulnerability management team, or similar function, is appropriately staffed and supported to implement and maintain VPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of vulnerability management operations (e.g., patch management solution and vulnerability scanning solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with VPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to track the effectiveness of remediation operations through metrics reporting.
Level 4 Quantitatively Controlled
Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Vulnerability & Patch Management (VPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
1. Forbhreathnú
1.1 Tagairtí
1.2 Ceanglais aitheanta
1.3 Rialacháin ghaolmhara
2. Ceanglais aitheanta
Ceanglais
| Foinse |
Ceanglas |
3. Rialacháin ghaolmhara
Rialacháin
| Foinse |
Rialáil |
|
EULAW
|
Airteagal 26 1
1. Déanfaidh eintitis airgeadais, nach eintitis dá dtagraítear in Airteagal 16(1), an chéád fhomhír, agus nach micrifhiontair iad, a shainaithnítear i gcomhréir le mír 8, an triú fomhír, den Airteagal seo, ardtástáil gach 3 bliana ar a laghad trí bhíthin TLPT. Bunaithe ar phróifíl riosca an eintitis airgeadais agus imthosca oibríochtúla á gcur san áireamh, féadfaidh an t-údarás inniúil, i gcás inar gá, a iarraidh ar an eintiteas airgeadais an mhinicíocht sin a laghdú nó a mhéadú.
|
|
EULAW
|
Airteagal 26 2
2. Cumhdófar le gach tástáil treáite bunaithe ar bhagairtí roinnt feidhmeanna agus seirbhísí criticiúla nó tábhachtacha de chuid eintitis airgeadais nó iad uile, agus déanfar an tástáil sin ar chórais táirgeachta bheo a thacaíonn leis na feidhmeanna sin.
Sainaithneoidh eintitis airgeadais gach bunchóras, bunphróiseas agus bunteicneolaíocht ábhartha TFC lena dtacaítear le feidhmeanna criticiúla nó tábhachtacha agus le seirbhísí TFC ábhartha uile, lena n-áirítear iad sin lena dtacaítear leis na feidhmeanna criticiúla nó tábhachtacha a seachfhoinsíodh chuig soláthraithe seirbhísí TFC tríú páirtí nó a cuireadh faoi cheangal conartha do sholáthraithe seirbhísí TFC tríú páirtí.
Déanfaidh eintitis airgeadais measúnú ar na feidhmeanna criticiúla is gá a bheith cumhdaithe ag TLPT. Cinnfear le toradh an mheasúnaithe sin raon feidhme beacht TLPT agus déanfaidh na húdaráis inniúla é a bhailíochtú.
|
|
EULAW
|
Airteagal 26 3
3. I gcás ina n-áireofar soláthraithe seirbhísí TFC tríú páirtí i raon feidhme TLPT, déanfaidh an t-eintiteas airgeadais na bearta agus na coimircí is gá chun rannpháirtíocht na soláthraithe seirbhísí TFC tríú páirtí sin in TLPT a áirithiú agus coinneoidh sé an fhreagracht iomlán i gcónaí as comhlíonadh an Rialacháin seo a áirithiú.
|
|
EULAW
|
Airteagal 26 4
4. Gan dochar do mhír 2, an chéad agus an dara fomhír, i gcás ina mbeifear ag súil go réasúnach leis go mbeidh drochthionchar ag rannpháirtíocht soláthraithe seirbhísí TFC tríú páirtí in TLPT, dá dtagraítear i mír 3, ar cháilíocht nó slándáil na seirbhísí a sholáthraíonn soláthraí seirbhísí TFC tríú páirtí do chustaiméirí ar eintitis iad nach dtagann faoi raon feidhme an Rialacháin seo, nó ar rúndacht na sonraí a bhaineann le seirbhísí den sórt sin, féadfaidh an t-eintiteas airgeadais agus soláthraí seirbhísí TFC tríú páirtí a chomhaontú i scríbhinn go ndéanfaidh soláthraí seirbhísí TFC tríú páirtí socruithe conarthacha go díreach le tástálaí seachtrach, chun TLPT comhchruinnithe a dhéanamh, faoi stiúir eintiteas airgeadais ainmnithe amháin, ina bhfuil roinnt eintiteas airgeadais páirteach (tástáil chomhthiomsaithe) a sholáthraíonn soláthraí seirbhísí TFC tríú páirtí seirbhísí TFC dóibh.
Cumhdófar leis an tástáil chomhthiomsaithe sin an raon ábhartha seirbhísí TFC lena dtacaítear leis na feidhmeanna criticiúla nó tábhachtacha atá curtha faoi cheangal conartha do sholáthraí seirbhísí TFC tríú páirtí faoi seach ag na heintitis airgeadais. Measfar an tástáil chomhthiomsaithe a bheith ina TLPT arna déanamh ag na heintitis airgeadais atá rannpháirteach sa tástáil chomhthiomsaithe.
Déanfar líon na n-eintiteas airgeadais atá rannpháirteach sa tástáil chomhthiomsaithe a chalabrú go cuí agus castacht agus cineálacha na seirbhísí lena mbaineann á gcur san áireamh.
|
|
EULAW
|
Airteagal 26 5
5. Déanfaidh eintitis airgeadais, i gcomhar le soláthraithe seirbhísí TFC tríú páirtí agus páirtithe eile lena mbaineann, lena n-áirítear na tástálaithe ach gan na húdaráis inniúla a chur san áireamh, rialuithe éifeachtacha bainistíochta riosca a chur i bhfeidhm chun maolú a dhéanamh ar na rioscaí a bhaineann le haon tionchar a d’fhéadfadh a bheith ar shonraí, damáiste do shócmhainní, agus suaitheadh ar fheidhmeanna, seirbhísí nó oibríochtaí criticiúla nó tábhachtacha ag an eintiteas airgeadais féin, a chontrapháirtithe nó ar an earnáil airgeadais.
|
|
EULAW
|
Airteagal 26 6
6. Ag deireadh na tástála, tar éis tuarascálacha agus pleananna feabhsúcháin a bheith comhaontaithe, cuirfidh an t-eintiteas airgeadais agus, i gcás inarb infheidhme, na tástálaithe seachtracha achoimre ar fáil don údarás, arna ainmniú i gcomhréir le mír 9 nó mír 10, ar na torthaí ábhartha, ar na pleananna feabhsúcháin agus ar an doiciméadacht lena léirítear go ndearnadh TLPT i gcomhréir leis na ceanglais.
|
|
EULAW
|
Airteagal 26 7
7. Tabharfaidh na húdaráis fianú d’eintitis airgeadais lena ndeimhneofar go ndearnadh an tástáil i gcomhréir leis na ceanglais mar a léirítear sa doiciméadacht chun go bhféadfar aitheantas frithpháirteach a thabhairt do thástálacha treáite bunaithe ar bhagairtí idir údaráis inniúla. Tabharfaidh an t-eintiteas airgeadais fógra don údarás inniúil ábhartha maidir leis an bhfianú, an achoimre ar na torthaí ábhartha agus na pleananna feabhsúcháin.
Gan dochar d’fhianú den sórt sin, leanfaidh eintitis airgeadais de bheith freagrach go hiomlán i gcónaí as tionchar na dtástálacha dá dtagraítear i mír 4.
|
|
EULAW
|
Airteagal 26 8
8. Déanfaidh eintitis airgeadais tástálaithe a chur faoi chonradh chun TLPT a dhéanamh i gcomhréir le hAirteagal 27. I gcás ina n-úsáideann eintitis airgeadais tástálaithe inmheánacha chun TLPT a dhéanamh, cuirfidh siad tástálaithe seachtrach faoi chonradh i ngach tríú tástáil.
Institiúidí creidmheasa a aicmítear mar eintitis shuntasacha i gcomhréir le hAirteagal 6(4) de Rialachán (AE) Uimh. 1024/2013, ní úsáidfidh siad ach tástálaithe seachtracha i gcomhréir le hAirteagal 27(1), pointí (a) go (e).
Sainaithneoidh na húdaráis inniúla eintitis airgeadais a gceanglaítear orthu TLPT a dhéanamh agus na critéir a leagtar amach in Airteagal 4(2) á gcur san áireamh, bunaithe ar mheasúnú ar an méid seo a leanas:
|
(a)
|
tosca a bhaineann le tionchar, go háirithe a mhéid a bhíonn tionchar ag na seirbhísí arna soláthar agus ag na gníomhaíochtaí a dhéanann an t-eintiteas airgeadais ar an earnáil airgeadais;
|
|
(b)
|
ábhair imní fhéideartha maidir le cobhsaíocht airgeadais, lena n-áirítear saintréithe sistéamacha an eintitis airgeadais ar leibhéal náisiúnta nó leibhéal an Aontais, de réir mar is infheidhme;
|
|
(c)
|
próifíl riosca shonrach TFC, leibhéal sonrach aibíochta TFC an eintitis airgeadais nó gnéithe sonracha teicneolaíochta atá i gceist.
|
|
|
EULAW
|
Airteagal 10 Bainistíocht leochaileachta agus bainistiú paistí
|
Saincheisteanna nasctha
- Secure Controls Framework -
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/
Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.
|