+26. pants Augsta riska MI sistēmu uzturētāju pienākumi
---+26. pants 1.
---+26. pants 2.
---+26. pants 3.
---+26. pants 4.
---+26. pants 5.
---+26. pants 6.
---+26. pants 7.
---+26. pants 8.
---+26. pants 9.
---+26. pants 10.
---+26. pants 11.
---+26. pants 12.

26. pants Augsta riska MI sistēmu uzturētāju pienākumi

-

1. Pārskats

,
26. pants 1.
Augsta riska MI sistēmu uzturētāji veic pienācīgus tehniskos un organizatoriskos pasākumus, lai nodrošinātu, ka viņi šādas sistēmas lieto saskaņā ar sistēmām pievienoto lietošanas instrukciju, ievērojot 3. un 6. punktu.
26. pants 2.
Uzturētāji uztic cilvēka virsvadību fiziskām personām, kurām ir vajadzīgā kompetence, apmācība un pilnvaras, kā arī nepieciešamais atbalsts.
26. pants 3.
Šā panta 1. un 2. punktā noteiktie pienākumi neskar citus uzturētāju pienākumus, kas noteikti Savienības vai valsts tiesību aktos, un uzturētāja brīvību organizēt savus resursus un darbības, lai īstenotu nodrošinātāja norādītos cilvēka virsvadības pasākumus.
26. pants 4.
Neskarot 1. un 2. punktu, ciktāl uzturētājs īsteno kontroli pār ievaddatiem, minētais uzturētājs nodrošina, ka ievaddati ir attiecīgi un pietiekami reprezentatīvi, ņemot vērā augsta riska MI sistēmai paredzēto nolūku.
26. pants 5.
Uzturētāji pārrauga augsta riska MI sistēmas darbību, pamatojoties uz lietošanas instrukciju, un attiecīgā gadījumā informē nodrošinātājus saskaņā ar 72. pantu. Ja uzturētājiem ir pamats uzskatīt, ka augsta riska MI sistēmas lietošana saskaņā ar instrukciju var radīt risku 79. panta 1. punkta nozīmē, viņi bez liekas kavēšanās informē nodrošinātāju vai izplatītāju un attiecīgo tirgus uzraudzības iestādi un aptur minētās sistēmas lietošanu. Ja uzturētāji ir identificējuši nopietnu incidentu, viņi par minēto incidentu arī nekavējoties informē vispirms nodrošinātāju un pēc tam importētāju vai izplatītāju un attiecīgās tirgus uzraudzības iestādes. Ja uzturētājs nevar sazināties ar nodrošinātāju, mutatis mutandis piemēro 73. pantu. Šis pienākums neattiecas uz MI sistēmu uzturētāju, kas ir tiesībaizsardzības iestādes, sensitīviem operatīvajiem datiem.

Attiecībā uz uzturētājiem, kas ir finanšu iestādes, uz kurām attiecas Savienības finanšu pakalpojumu jomas tiesību aktos paredzētās prasības par to iekšējo pārvaldību, kārtību vai procesiem, pirmajā daļā noteikto pārraudzības pienākumu uzskata par izpildītu, ja ir izpildīti noteikumi par iekšējās pārvaldības kārtību, procesiem un mehānismiem, ievērojot attiecīgos tiesību aktus finanšu pakalpojumu jomā.
26. pants 6.
Augsta riska MI sistēmu uzturētāji glabā minētās augsta riska MI sistēmas ģenerētās žurnāldatnes, ciktāl šādas žurnāldatnes ir viņu pārziņā, tādu laikposmu, kas atbilst augsta riska MI sistēmai paredzētajam nolūkam – vismaz sešus mēnešus, ja vien piemērojamajos Savienības vai valsts tiesību aktos, jo īpaši Savienības tiesību aktos par personas datu aizsardzību, nav noteikts citādi.

Uzturētāji, kas ir finanšu iestādes, uz kurām attiecas Savienības finanšu pakalpojumu jomas tiesību aktos paredzētās prasības par to iekšējo pārvaldību, kārtību vai procesiem, žurnāldatnes uztur kā daļu no dokumentācijas, kuru glabā, ievērojot attiecīgos Savienības tiesību aktus finanšu pakalpojumu jomā.
26. pants 7.
Pirms augsta riska MI sistēmas nodošanas ekspluatācijā vai lietošanas darbavietā uzturētāji, kas ir darba devēji, informē darba ņēmēju pārstāvjus un skartos darba ņēmējus par to, ka uz viņiem attieksies augsta riska MI sistēmas lietošana. Šo informāciju attiecīgā gadījumā sniedz saskaņā ar noteikumiem un procedūrām, kas paredzētas Savienības un valsts tiesību aktos un praksē attiecībā uz darba ņēmēju un viņu pārstāvju informēšanu.
26. pants 8.
Augsta riska MI sistēmu uzturētāji, kas ir publiskas iestādes, vai Savienības iestādes, struktūras, biroji vai aģentūras pilda 49. pantā minētos reģistrācijas pienākumus. Ja šādi uzturētāji konstatē, ka augsta riska MI sistēma, kuru viņi plāno lietot, nav reģistrēta 71. pantā minētajā ES datubāzē, viņi minēto sistēmu nelieto un informē nodrošinātāju vai izplatītāju.
26. pants 9.
Attiecīgā gadījumā augsta riska MI sistēmu uzturētāji izmanto saskaņā ar šīs regulas 13. pantu sniegto informāciju, lai izpildītu pienākumu veikt novērtējumu par ietekmi uz datu aizsardzību, kā paredzēts Regulas (ES) 2016/679 35. pantā vai Direktīvas (ES) 2016/680 27. pantā.
26. pants 10.
Neskarot Direktīvu (ES) 2016/680, lai izmeklēšanas ietvaros veiktu personas, kas tiek turēta aizdomās vai ir notiesāta par noziedzīga nodarījuma izdarīšanu, mērķtiecīgu meklēšanu, vēlāklaika biometriskās identifikācijai paredzētas augsta riska MI sistēmas uzturētājs ex-ante vai bez liekas kavēšanās un ne vēlāk kā 48 stundu laikā lūdz tiesu iestādei vai administratīvai iestādei, kuras lēmums ir saistošs un uz ko attiecas tiesas pārbaude, atļauju lietot minēto sistēmu, izņemot gadījumus, kad tā tiek lietota potenciāla aizdomās turamā sākotnējai identifikācijai, pamatojoties uz objektīviem un pārbaudāmiem faktiem, kas ir tieši saistīti ar nodarījumu. Katra lietošana ir ierobežota un attiecas tikai uz to, kas ir absolūti nepieciešams konkrēta noziedzīga nodarījuma izmeklēšanai.

Ja atļauja, kas pieprasīta, ievērojot pirmo daļu, netiek piešķirta, ar minēto pieprasīto atļauju saistīto vēlāklaika biometriskās identifikācijas sistēmas lietošanu nekavējoties pārtrauc un personas datus, kas saistīti ar tādu augsta riska MI sistēmas lietošanu, par kuru tika lūgta atļauja, dzēš.

Nekādā gadījumā šādu vēlāklaika biometriskās identifikācijai paredzētu augsta riska MI sistēmu nelieto tiesībaizsardzības nolūkos nemērķorientētā veidā, bez kādas saistības ar noziedzīgu nodarījumu, kriminālprocesu, reāliem un pašreizējiem vai reāliem un paredzamiem noziedzīga nodarījuma draudiem vai konkrētas pazudušas personas meklēšanu. Nodrošina, ka lēmumu, kas personai rada nelabvēlīgas tiesiskas sekas, tiesībaizsardzības iestādes nevar pieņemt, balstoties vienīgi uz šādu vēlāklaika biometriskās tālidentifikācijas sistēmu sniegto iznākumu.

Šis punkts neskar Regulas (ES) 2016/679 9. pantu un Direktīvas (ES) 2016/680 10. pantu attiecībā uz biometrisko datu apstrādi.

Neatkarīgi no nolūka vai uzturētāja katru šādu augsta riska MI sistēmu lietošanu dokumentē attiecīgā policijas datnē un pēc pieprasījuma dara pieejamu attiecīgajai tirgus uzraudzības iestādei un valsts datu aizsardzības iestādei, izņemot ar tiesībaizsardzību saistītu sensitīvu operatīvo datu izpaušanu. Šī daļa neskar pilnvaras, kas ar Direktīvu (ES) 2016/680 piešķirtas uzraudzības iestādēm.

Uzturētāji iesniedz attiecīgajai tirgus uzraudzības iestādei un valsts datu aizsardzības iestādei gada ziņojumus par gadījumiem, kad tie lietojuši vēlāklaika biometriskās tālidentifikācijas sistēmas, izņemot ar tiesībaizsardzību saistītu sensitīvu operatīvo datu izpaušanu. Ziņojumus var agregēt, lai vienā operācijā aptvertu vairāk nekā vienu ieviešanu.

Dalībvalstis saskaņā ar Savienības tiesību aktiem var ieviest ierobežojošākus tiesību aktus par vēlāklaika biometriskās tālidentifikācijas sistēmu lietošanu.
26. pants 11.
Neskarot šīs regulas 50. pantu, III pielikumā minēto augsta riska MI sistēmu uzturētāji, kas pieņem lēmumus vai palīdz pieņemt lēmumus saistībā ar fiziskām personām, informē fiziskas personas, ka uz tām attiecas augsta riska MI sistēmas lietošana. Augsta riska MI sistēmām, ko izmanto tiesībaizsardzības nolūkos, piemēro Direktīvas (ES) 2016/680 13. pantu.
26. pants 12.
Uzturētāji sadarbojas ar attiecīgajām kompetentajām iestādēm visās darbībās, ko minētās iestādes šīs regulas īstenošanas nolūkā veic saistībā ar augsta riska MI sistēmu.

1.1 Atsauces

1.2 Identificētās prasības

1.3 Saistītie standarti

2. Identificētās prasības

Prasības

3. Saistītie standarti

Standarti
SCF AI & Autonomous Technologies Deployment

Description

Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Deploy AI tools only for documented, approved purposes

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI deployment approval process
∙ Document intended use and technical measures

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI deployment policy
∙ Technical and organizational measures for AI deployment

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI deployment governance program
∙ Formal approval workflows
∙ Post-deployment monitoring

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI deployment governance framework
∙ Automated deployment controls
∙ Continuous monitoring
∙ Regulatory compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions for use.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Oversight Functions Competency

Description

Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Train AI system operators on oversight responsibilities

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Training program for personnel overseeing AI systems

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI oversight training program
∙ Competency requirements for AI oversight roles

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI training and certification program for oversight personnel

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI training and certification program
∙ Role-based AI competency framework
∙ Continuous learning program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Data Relevance

Description

Mechanisms exist to ensure the input to Artificial Intelligence (AI) and Autonomous Technologies (AAT) is relevant to the intended purpose of the AAT.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Validate that inputs to AI tools are relevant before submitting

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Policy requiring relevance checking of AI inputs

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI input validation policy
∙ Input relevance criteria documentation

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Input validation controls for AI systems
∙ Automated input filtering

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI input governance framework
∙ Automated input validation and filtering
∙ Data quality controls for AI pipelines

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the input to AAT is relevant to the intended purpose of the AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Irregularity Reporting

Description

Mechanisms exist to ensure serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Report serious AI incidents and irregularities to management

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Incident reporting procedure for AI irregularities

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI incident and irregularity reporting policy
∙ Regulatory reporting contacts

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI incident response program with regulatory reporting integration

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI incident management platform
∙ Automated regulatory notification
∙ Legal and compliance integration

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure serious incidents and/or irregularities associated with the deployment of AAT are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Use Notification To Employees

Description

Mechanisms exist to ensure employees, including workers' representatives, are informed about Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments, prior to the use of the AAT in a production environment.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Inform employees of AI tools being used in their work

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Policy requiring employee notification of AI tools affecting their work

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal employee notification policy for AI deployments
∙ Communication procedures

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI transparency program for employees
∙ Works council/union notification as required

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI employee transparency framework
∙ Formal notification procedures
∙ Labor law compliance tracking

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure employees, including workers' representatives, are informed about AAT deployments, prior to the use of the AAT in a production environment.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Use Notification To Users

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Inform users when AI is making or assisting decisions affecting them

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ User notification policy for AI-assisted decisions

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal user notification policy and procedures for AI decision support

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI user transparency program
∙ Automated user notifications for AI decisions

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI user transparency framework
∙ Automated disclosure mechanisms
∙ Regulatory compliance (EU AI Act, GDPR)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Event Logging

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Enable basic logging on AI/ML systems

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Configure event logging on AI systems
∙ Define log retention periods

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI event logging policy
∙ Centralized log collection

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ SIEM integration for AI system logs
∙ Defined logging standards for AI platforms

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise SIEM platform
∙ Standardized AI event logging schema
∙ Automated alerting for anomalous AI events

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Registration

Description

Mechanisms exist to maintain a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing body, as required by statutory or regulatory requirements.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Determine whether any AI use requires registration (e.g., EU AI Act high-risk systems)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Track AI registration obligations by jurisdiction in compliance checklist

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Register high-risk AI systems with relevant authorities as required

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI registration compliance program
∙ Track registration requirements by jurisdiction

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI regulatory compliance platform
∙ Automated registration tracking
∙ EU AI Act database registration compliance

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to maintain a current registration for AAT with the appropriate governing body, as required by statutory or regulatory requirements.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Data Protection Impact Assessment (DPIA)

Description

Mechanisms exist to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).

Level 3 Well Defined

Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.

Level 4 Quantitatively Controlled

Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.