+31 straipsnis IRT paslaugas teikiančių trečiųjų šalių pripažinimas esančiomis ypatingos svarbos
---+31 straipsnis 1
---+31 straipsnis 2
---+31 straipsnis 3
---+31 straipsnis 4
---+31 straipsnis 5
---+31 straipsnis 6
---+31 straipsnis 7
---+31 straipsnis 8
---+31 straipsnis 9
---+31 straipsnis 10
---+31 straipsnis 11
---+31 straipsnis 12
---+31 straipsnis 13
|
31 straipsnis IRT paslaugas teikiančių trečiųjų šalių pripažinimas esančiomis ypatingos svarbos
-
1. Apžvalga
| Pavadinimas |
Reguliavimas |
|
31 straipsnis 1
|
1. EPI per Jungtinį komitetą ir remdamosi Priežiūros forumo, įsteigto pagal 32 straipsnio 1 dalį, rekomendacija:
|
a)
|
IRT paslaugas teikiančias trečiąsias šalis pripažįsta esančiomis ypatingai svarbiomis finansų sektoriaus subjektams, atlikus įvertinimą, kuriuo atsižvelgiama į 2 dalyje nurodytus kriterijus;
|
|
b)
|
kiekvienai ypatingos svarbos IRT paslaugas teikiančiai trečiajai šaliai Atsakingąja priežiūros institucija paskiria EPI, kuri pagal reglamentus (ES) Nr. 1093/2010, (ES) Nr. 1094/2010 ar (ES) Nr. 1095/2010 yra atsakinga už finansų sektoriaus subjektus, kurie visi kartu valdo didžiausią bendro turto dalį, vertinant visų finansų sektoriaus subjektų, kurie naudojasi atitinkamos ypatingos svarbos IRT paslaugas teikiančios trečiosios šalies, paslaugomis, bendro turto verte, kurią įrodo tų finansų sektoriaus subjektų atskirų balansų suma.
|
|
|
31 straipsnis 2
|
2. 1 dalies a punkte nurodytas pripažinimas grindžiamas visais toliau nurodytais kriterijais, susijusiais su IRT paslaugas teikiančios trečiosios šalies teikiamomis IRT paslaugomis:
|
a)
|
sisteminiu poveikiu finansinių paslaugų teikimo stabilumui, tęstinumui ar kokybei tuo atveju, jei atitinkama IRT paslaugas teikianti trečioji šalis patirtų didelį veiklos sutrikimą, trukdantį teikti paslaugas, atsižvelgiant į finansų sektoriaus subjektų skaičių ir į finansų sektoriaus subjektų, kuriems atitinkama IRT paslaugas teikianti trečioji šalis teikia paslaugas, bendrą turto vertę;
|
|
b)
|
finansų sektoriaus subjektų, kurie yra priklausomi nuo atitinkamos IRT paslaugas teikiančios trečiosios šalies, sisteminiu pobūdžiu arba svarba, vertinant pagal šiuos parametrus:
|
i)
|
pasaulinės sisteminės svarbos įstaigų (G-SII) ar kitų sisteminės svarbos įstaigų (O-SII), kurios yra priklausomos nuo atitinkamos IRT paslaugas teikiančios trečiosios šalies, skaičių;
|
|
ii)
|
i punkte nurodytų G-SII arba O-SII ir kitų finansų sektoriaus subjektų tarpusavio priklausomybę, įskaitant atvejus, kai G-SII arba O-SII teikia finansinės infrastruktūros paslaugas kitiems finansų sektoriaus subjektams;
|
|
|
c)
|
finansų sektoriaus subjektų priklausomybe nuo atitinkamos IRT paslaugas teikiančios trečiosios šalies teikiamų paslaugų, susijusių su finansų sektoriaus subjektų ypatingos svarbos arba svarbiomis funkcijomis, kurios galiausiai yra siejamos su ta pačia IRT paslaugas teikiančią trečiąja šalimi, neatsižvelgiant į tai, ar finansų sektoriaus subjektai yra priklausomi nuo tokių paslaugų tiesiogiai ar netiesiogiai pagal subrangos susitarimus;
|
|
d)
|
IRT paslaugas teikiančios trečiosios šalies pakeičiamumu, atsižvelgiant į šiuos parametrus:
|
i)
|
realių alternatyvų, net ir dalinių, trūkumą dėl nedidelio konkrečioje rinkoje veiklą vykdančių IRT paslaugas teikiančių trečiųjų šalių skaičiaus, atitinkamos IRT paslaugas teikiančios trečiosios šalies rinkos dalies, susijusio techninio sudėtingumo ar pažangumo, be kita ko, dėl bet kokios nuosavybinės technologijos, arba IRT paslaugas teikiančios trečiosios šalies organizacinių ar veiklos ypatumų;
|
|
ii)
|
sunkumus iš dalies arba visiškai perkelti atitinkamus duomenis ir darbo krūvį iš atitinkamos IRT paslaugas teikiančios trečiosios šalies į kitą IRT paslaugas teikiančią trečiąją šalį arba dėl didelių finansinių išlaidų, laiko ar kitų išteklių, kurių gali prireikti perkėlimo procesui, arba dėl padidėjusios IRT rizikos ar kitos operacinės rizikos, su kuria finansų sektoriaus subjektas gali susidurti tokio perkėlimo metu.
|
|
|
|
31 straipsnis 3
|
3. Jei IRT paslaugas teikianti trečioji šalis priklauso grupei, 2 dalyje nurodyti kriterijai vertinami visos grupės teikiamų paslaugų atžvilgiu.
|
|
31 straipsnis 4
|
4. Ypatingos svarbos IRT paslaugas teikiančios trečiosios šalys, priklausančios grupei, paskiria vieną juridinį asmenį koordinavimo punktu, kad būtų užtikrintas tinkamas atstovavimas ir komunikacija su Atsakingąja priežiūros institucija.
|
|
31 straipsnis 5
|
5. Atsakingoji priežiūros institucija praneša IRT paslaugas teikiančiai trečiajai šaliai apie vertinimo, kurio rezultatas būtų 1 dalies a punkte nurodytas pripažinimas, išvadas. Per 6 savaites nuo pranešimo dienos IRT paslaugas teikianti trečioji šalis gali pateikti Atsakingajai priežiūros institucijai pagrįstą pareiškimą su visa vertinimui reikalinga informacija. Atsakingoji priežiūros institucija apsvarsto pagrįstą pareiškimą ir gali paprašyti per 30 kalendorinių dienų pateikti papildomos informacijos nuo tokio pareiškimo gavimo dienos.
Pripažinusios IRT paslaugas teikiančią trečiąją šalį esančia ypatingos svarbos, EPI per Jungtinį komitetą praneša IRT paslaugas teikiančiai trečiajai šaliai apie tokį pripažinimą ir datą, nuo kurios ji faktiškai bus prižiūrima. Ta pradžios data turi būti ne vėlesnė kaip vienas mėnuo nuo pranešimo. IRT paslaugas teikianti trečioji šalis praneša finansų sektoriaus subjektams, kuriems ji teikia paslaugas, apie jos pripažinimą esančia ypatingos svarbos.
|
|
31 straipsnis 6
|
6. Komisijai pagal 57 straipsnį suteikiami įgaliojimai priimti deleguotąjį aktą, kuriuo šis reglamentas būtų papildytas patikslinant šio straipsnio 2 dalyje nurodytus kriterijus, ne vėliau kaip 2024 m. liepos 17 d.
|
|
31 straipsnis 7
|
7. 1 dalies a punkte nurodytas pripažinimas taikomas tik tada, kai Komisija priima deleguotąjį aktą pagal 6 dalį.
|
|
31 straipsnis 8
|
8. 1 dalies a punkte nurodytas pripažinimas netaikomas:
|
i)
|
finansų sektoriaus subjektams, teikiantiems IRT paslaugas kitiems finansų sektoriaus subjektams;
|
|
ii)
|
IRT paslaugas teikiančioms trečiosioms šalims, kurioms taikomos priežiūros sistemos, nustatytos siekiant padėti atlikti užduotis, nurodytas Sutarties dėl Europos Sąjungos veikimo 127 straipsnio 2 dalyje;
|
|
iii)
|
grupės vidaus IRT paslaugų teikėjams;
|
|
iv)
|
IRT paslaugas teikiančioms trečiosioms šalims, teikiančioms IRT paslaugas tik vienoje valstybėje narėje finansų sektoriaus subjektams, kurie vykdo veiklą tik toje valstybėje narėje.
|
|
|
31 straipsnis 9
|
9. EPI per Jungtinį komitetą sudaro, skelbia ir kasmet atnaujina Sąjungos lygmens ypatingos svarbos IRT paslaugas teikiančių trečiųjų šalių sąrašą.
|
|
31 straipsnis 10
|
10. 1 dalies a punkto tikslais kompetentingos institucijos kasmet apibendrina ir perduoda 28 straipsnio 3 dalies trečioje pastraipoje nurodytus pranešimus Priežiūros forumui, įsteigtam pagal 32 straipsnį. Priežiūros forumas įvertina finansų sektoriaus subjektų priklausomybę nuo IRT paslaugas teikiančių trečiųjų šalių, remdamasis iš kompetentingų institucijų gauta informacija.
|
|
31 straipsnis 11
|
11. IRT paslaugas teikiančios trečiosios šalys, neįtrauktos į 9 dalyje nurodytą sąrašą, gali prašyti, kad jas pripažintų esančiomis ypatingos svarbos pagal 1 dalies a punktą.
Pirmos pastraipos tikslais IRT paslaugas teikianti trečioji šalis pateikia pagrįstą prašymą EBI, ESMA arba EIOPA, kurios Jungtiniame komitete nusprendžia, ar pripažinti tą IRT paslaugas teikiančią trečiąją šalį esančia ypatingos svarbos pagal 1 dalies a punktą.
Antroje pastraipoje nurodytas sprendimas priimamas ir apie jį IRT paslaugas teikiančiai trečiajai šaliai pranešama per 6 mėnesius nuo prašymo gavimo dienos.
|
|
31 straipsnis 12
|
12. Finansų sektoriaus subjektai naudojasi trečiojoje valstybėje įsteigtos IRT paslaugas teikiančios trečiosios šalies, pripažintos esančia ypatingos svarbos pagal 1 dalies a punktą, paslaugomis tik tuo atveju, jei pastaroji per 12 mėnesių nuo pripažinimo įsteigė patronuojamąją įmonę Sąjungoje.
|
|
31 straipsnis 13
|
13. 12 dalyje nurodyta ypatingos svarbos IRT paslaugas teikianti trečioji šalis praneša Atsakingajai priežiūros institucijai apie visus Sąjungoje įsteigtos patronuojamosios įmonės valdymo struktūros pasikeitimus.
|
,
1.1 Nuorodos
1.2 Nustatyti reikalavimai
1.3 Susiję standartai
2. Nustatyti reikalavimai
Reikalavimai
| Šaltinis |
Reikalavimas |
3. Susiję standartai
Standartai
| Šaltinis |
Reikalavimas |
|
SCF
|
Contacts With Authorities
Description
Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Documented list of law enforcement and regulatory contacts (FBI, CISA, state AG)
∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Documented contacts with FBI Cyber Division, CISA, and relevant regulators
∙ MS-ISAC or sector-specific ISAC membership
∙ Pre-established law enforcement liaisons for incident response
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Integrated Security Incident Response Team (ISIRT) with defined authority contacts
∙ CISA Cyber Liaison and FBI Cyber Division contacts
∙ Sector ISAC membership (e.g., FS-ISAC, H-ISAC, E-ISAC)
∙ Regulatory notification contact list (e.g., FTC, OCR, state regulators)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Integrated Security Incident Response Team (ISIRT) with pre-established authority relationships
∙ Formal engagement with law enforcement (FBI, USSS, CISA)
∙ Sector ISAC active membership with information sharing participation
∙ Regulatory breach notification contacts and documented procedures
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Dedicated government liaison program (FBI, CISA, NSA, sector regulators)
∙ Active ISAC membership with classified threat briefing access (where applicable)
∙ Pre-established breach notification workflows for all applicable regulators
∙ Integrated Security Incident Response Team (ISIRT) with 24/7 law enforcement contact protocols
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.
▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.
▪ Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
Level 2 Planned Tracked
Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ An implemented and operational capability exists to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Level 4 Quantitatively Controlled
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|