+Artikolu 15 Akkuratezza, robustezza u ċibersigurtà
---+Artikolu 15 1.
---+Artikolu 15 2.
---+Artikolu 15 3.
---+Artikolu 15 4.
---+Artikolu 15 5.

Artikolu 15 Akkuratezza, robustezza u ċibersigurtà

-

1. Ħarsa ġenerali

,
Artikolu 15 1.
Is-sistemi tal-IA b'riskju għoli għandhom jiġu ddisinjati u żviluppati b'tali mod li jiksbu livell xieraq ta' akkuratezza, robustezza u ċibersigurtà, u li l-prestazzjoni tagħhom fir-rigward ta' dawk l-aspetti tkun konsistenti tul iċ-ċiklu tal-ħajja tagħhom.
Artikolu 15 2.
Sabiex tindirizza l-aspetti tekniċi ta' kif jitkejlu l-livelli xierqa ta' akkuratezza u robustezza stipulati fil-paragrafu 1 u kwalunkwe metrika tal-prestazzjoni rilevanti oħra, il-Kummissjoni għandha, f'kooperazzjoni mal-partijiet ikkonċernati u l-organizzazzjonijiet rilevanti bħall-metroloġija u l-awtoritajiet tal-valutazzjoni komparattiva, tħeġġeġ kif xieraq, l-iżvilupp ta' parametri referenzjarji u metodoloġiji tal-kejl.
Artikolu 15 3.
Il-livelli ta' akkuratezza u l-metrika tal-akkuratezza rilevanti tas-sistemi tal-IA b'riskju għoli għandhom jiġu dikjarati fl-istruzzjonijiet tal-użu li jakkumpanjawhom.
Artikolu 15 4.
Is-sistemi tal-IA b'riskju għoli għandhom ikunu kemm jista' jkun reżiljenti fir-rigward ta' żbalji, ħsarat jew inkonsistenzi li jistgħu jseħħu fis-sistema jew fl-ambjent li fih topera s-sistema, b'mod partikolari minħabba l-interazzjoni tagħhom ma' persuni fiżiċi jew ma' sistemi oħra. F'dan ir-rigward għandhom jittieħdu miżuri tekniċi u organizzattivi.

Ir-robustezza tas-sistemi tal-IA b'riskju għoli tista' tinkiseb b'soluzzjonijiet tekniċi ta' ridondanza, li jistgħu jinkludu pjanijiet ta' backup jew ta' fail-safe.

Is-sistemi tal-IA b'riskju għoli li jkomplu jitgħallmu wara li jiġu introdotti fis-suq jew jitqiegħdu fis-servizz għandhom jiġu żviluppati b'tali mod li jeliminaw jew inaqqsu kemm jista' jkun ir-riskju li outputs possibbilment ippreġudikati jinfluwenzaw l-input għal operazzjonijiet futuri (“feedback loops”), u biex jiġi żgurat li kwalunkwe feedback loop bħal dan jiġi indirizzat kif xieraq b'miżuri ta' mitigazzjoni xierqa.
Artikolu 15 5.
Is-sistemi tal-IA b'riskju għoli għandhom ikunu reżiljenti kontra tentattivi minn partijiet terzi mhux awtorizzati biex ibiddlu l-użu, l-outputs jew il-prestazzjoni tagħhom billi jisfruttaw il-vulnerabbiltajiet tas-sistema.

Is-soluzzjonijiet tekniċi mmirati biex jiżguraw iċ-ċibersigurtà tas-sistemi tal-IA b'riskju għoli għandhom ikunu xierqa għaċ-ċirkostanzi rilevanti u għar-riskji.

Is-soluzzjonijiet tekniċi biex jiġu indirizzati vulnerabbiltajiet speċifiċi tal-IA għandhom jinkludu, fejn xieraq, miżuri għall-prevenzjoni, il-kxif, ir-rispons għal, ir-riżoluzzjoni u l-kontroll ta' attakki li jippruvaw jimmanipulaw is-sett tad-data għat-taħriġ (avvelenament tad-data), jew komponenti mħarrġa minn qabel użati fit-taħriġ (avvelenament tal-mudell), inputs imfassla biex jġiegħlu lill-mudell tal-IA jiżbalja (eżempji kontradittorji jew evażjoni tal-mudell), attakki fuq il-kunfidenzjalità jew difetti fil-mudell.

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Standards relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Standards relatati

Standards
SCF AI & Autonomous Technologies Development Practices

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) are designed and developed to:
(1) Achieve an appropriate level of accuracy, robustness and cybersecurity;
(2) Perform consistently in those respects throughout the AAT system's lifecycle; and
(3) Be effectively overseen by competent individuals.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Document accuracy and robustness requirements before adopting AI

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI design requirements checklist covering accuracy, robustness, cybersecurity

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI development standards
∙ Security-by-design requirements for AI

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI development security standards
∙ Formal SDLC integration
∙ Security testing requirements

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI development framework
∙ AI security standards (NIST AI RMF, ISO 42001)
∙ DevSecOps integration for AI

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Measures exist to ensure AAT are designed and developed to:
(1) Achieve an appropriate level of accuracy, robustness and cybersecurity;
(2) Perform consistently in those respects throughout the AAT system's lifecycle; and
(3) Be effectively overseen by competent individuals.

Level 4 Quantitatively Controlled

Artificial Intelligence and Autonomous Technology (AAT) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Artificial Intelligence and Autonomous Technology (AAT) capabilities are "world class" efforts the leverage predictive analysis (e.g., machine learning and AI) to enable continuously improving capabilities. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
SCF AI & Autonomous Technologies Implementation Documentation

Description

Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides:
(1) Contact details of the provider;
(2) Characteristics, capabilities and limitations of performance of the AAT;
(3) Errata from the AAT's initial conformity assessment;
(4) Details necessary to interpret the outputs of the AAT;
(5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT;
(6) Computational and hardware resources needed to operate the AAT;
(7) Projected useable lifetime of the AAT; and
(8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Document AI implementation steps and configuration

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ AI implementation documentation template

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal AI implementation documentation policy
∙ Technical documentation requirements

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ AI documentation program
∙ Standardized implementation documentation templates

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise AI documentation platform
∙ Automated documentation generation from MLOps tools
∙ Model cards and system cards

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT include clear and concise documentation that is relevant, accessible and comprehensible to personnel implementing and maintaining the AAT that, at a minimum, provides:
(1) Contact details of the provider;
(2) Characteristics, capabilities and limitations of performance of the AAT;
(3) Errata from the AAT's initial conformity assessment;
(4) Details necessary to interpret the outputs of the AAT;
(5) Human oversight measures necessary to facilitate the interpretation of the outputs of the AAT;
(6) Computational and hardware resources needed to operate the AAT;
(7) Projected useable lifetime of the AAT; and
(8) A description of the mechanisms included within the AAT system to properly collect, store and interpret event logs.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF AI & Autonomous Technologies Production Monitoring

Description

Mechanisms exist to monitor the functionality and behavior of the deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Formal product management practices
∙ Artificial Intelligence (AI) / autonomous technologies governance program

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.

Level 2 Planned Tracked

Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.

Level 3 Well Defined

Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to monitor the functionality and behavior of the deployed AAT.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Achieving Security, Compliance & Resilience Requirements

Description

Mechanisms exist to design Technology Assets, Applications and/or Services (TAAS) so that required capabilities continue to operate in a controlled and acceptable manner, when conditions are both routine and degraded.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Defined "secure engineering principles" (e.g., alignment with NIST 800-160)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Secure Engineering & Architecture (SEA) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with SEA domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Security engineering-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to design, build and maintain secure, compliant and resilient solutions.

Level 2 Planned Tracked

Secure Engineering & Architecture (SEA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Secure engineering and architecture-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Secure engineering and architecture management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel define entity-specific secure engineering practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the entity's TAASD.
▪ IT and/or cybersecurity personnel align secure engineering practices with the entity's broader IT architecture practices.
▪ IT and/or cybersecurity personnel use secure engineering practices to influence Secure Baseline Configurations (SBC).

Level 3 Well Defined

Secure Engineering & Architecture (SEA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with SEA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with SEA domain capabilities are well-documented and kept current by process owners.
▪ A cybersecurity engineering / architecture team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of secure engineering management operations (e.g., project management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with SEA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Secure Baseline Configurations (SBC) enforce the secure engineering principles on all applicable Technology Assets, Applications and/or Services (TAAS).
▪ An implemented and operational capability exists to achieve resilience requirements in normal and adverse situations.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.