+Artikolu 26 Obbligi tal-implimentaturi ta' sistemi tal-IA b'riskju għoli
---+Artikolu 26 1.
---+Artikolu 26 2.
---+Artikolu 26 3.
---+Artikolu 26 4.
---+Artikolu 26 5.
---+Artikolu 26 6.
---+Artikolu 26 7.
---+Artikolu 26 8.
---+Artikolu 26 9.
---+Artikolu 26 10.
---+Artikolu 26 11.
---+Artikolu 26 12.
|
Artikolu 26 Obbligi tal-implimentaturi ta' sistemi tal-IA b'riskju għoli
-
1. Ħarsa ġenerali
| Titlu |
Regolamentazzjoni |
|
Artikolu 26 1.
|
L-implimentaturi ta' sistemi tal-IA b'riskju għoli għandhom jieħdu miżuri tekniċi u organizzazzjonali xierqa biex jiżguraw li jużaw dawn is-sistemi f'konformità mal-istruzzjonijiet għall-użu li jakkumpanjaw is-sistemi, skont il-paragrafi 3 u 6.
|
|
Artikolu 26 2.
|
L-implimentaturi għandhom jassenjaw sorveljanza mill-bniedem lil persuni fiżiċi li għandhom il-kompetenza, it-taħriġ u l-awtorità meħtieġa, kif ukoll l-appoġġ meħtieġ.
|
|
Artikolu 26 3.
|
L-obbligi stipulati fil-paragrafi 1 u 2, huma mingħajr preġudizzju għal obbligi oħra tal-implimentatur skont il-liġi tal-Unjoni jew il-liġi nazzjonali u għal-libertà tal-implimentatur li jorganizza r-riżorsi u l-attivitajiet proprji tiegħu għall-fini tal-implimentazzjoni tal-miżuri tas-sorveljanza mill-bniedem indikati mill-fornitur.
|
|
Artikolu 26 4.
|
Mingħajr preġudizzju għall-paragrafi 1 u 2, sa fejn l-implimentatur jeżerċita kontroll fuq id-data tal-input, dak l-implimentatur għandu jiżgura li d-data tal-input tkun rilevanti u rappreżentattiva biżżejjed fid-dawl tal-għan maħsub tas-sistema tal-IA b'riskju għoli.
|
|
Artikolu 26 5.
|
L-implimentaturi għandhom jimmonitorjaw it-tħaddim tas-sistema tal-IA b'riskju għoli abbażi tal-istruzzjonijiet għall-użu u, meta rilevanti, jinfurmaw lill-fornituri f'konformità mal-Artikolu 72. Meta l-implimentaturi jkollhom raġuni biex iqisu li l-użu tas-sistema tal-IA b'riskju għoli f'konformità mal-istruzzjonijiet jista' jirriżulta f’dik is-sistema tal-IA tippreżenta riskju skont it-tifsira tal-Artikolu 79(1), huma għandhom, mingħajr dewmien żejjed, jinfurmaw lill-fornitur jew lid-distributur u lill-awtorità tas-sorveljanza tas-suq rilevanti u għandhom jissospendu l-użu ta' dik is-sistema. Meta l-implimentaturi jkunu identifikaw inċident serju, huma għandhom jinfurmaw minnufih ukoll l-ewwel lill-fornitur, u mbagħad lill-importatur jew lid-distributur u lill-awtoritajiet rilevanti tas-sorveljanza tas-suq dwar dak l-inċident. F'każ li l-implimentatur ma jkunx jista' jikkuntattja lill-fornitur, l-Artikolu 73 għandu japplika mutatis mutandis. Dan l-obbligu ma għandux ikopri data operazzjonali sensittiva tal-implimentaturi tas-sistemi tal-IA li huma awtoritajiet tal-infurzar tal-liġi. Għall-implimentaturi li huma istituzzjonijiet finanzjarji soġġetti għal rekwiżiti rigward il-governanza, l-arranġamenti jew il-proċessi interni tagħhom skont il-liġi tal-Unjoni dwar is-servizzi finanzjarji, l-obbligu ta' monitoraġġ stipulat fl-ewwel subparagrafu għandu jitqies issodisfat billi jiġu konformi mar-regoli dwar l-arranġamenti, il-proċessi u l-mekkaniżmi ta' governanza interna skont il-liġi rilevanti dwar is-servizzi finanzjarji.
|
|
Artikolu 26 6.
|
L-implimentaturi tas-sistemi tal-IA b'riskju għoli għandhom iżommu r-reġistri ġġenerati awtomatikament minn dik is-sistema tal-IA b'riskju għoli sa fejn dawn ir-reġistri jkunu fil-kontroll tagħhom għal perjodu xieraq għall-għan maħsub tas-sistema tal-IA b'riskju għoli, ta' mill-inqas sitt xhur, sakemm ma jkunx previst mod ieħor fil-liġi tal-Unjoni jew dik nazzjonali applikabbli, b’mod partikolari fil-liġi tal-Unjoni dwar il-protezzjoni tad-data personali. L-implimentaturi li huma istituzzjonijiet finanzjarji soġġetti għal rekwiżiti rigward il-governanza, l-arranġamenti jew il-proċessi interni tagħhom skont il-liġi tal-Unjoni dwar is-servizzi finanzjarji għandhom iżommu r-reġistri bħala parti mid-dokumentazzjoni miżmuma skont il-liġi rilevanti tal-Unjoni dwar is-servizzi finanzjarji.
|
|
Artikolu 26 7.
|
Qabel ma jqiegħdu fis-servizz jew jużaw sistema tal-IA b’riskju għoli fuq il-post tax-xogħol, l-implimentaturi li jkunu impjegaturi għandhom jinfurmaw lir-rappreżentanti tal-ħaddiema u lill-ħaddiema affettwati li ser ikunu soġġetti għall-użu tas-sistema tal-AI b’riskju għoli. Din l-informazzjoni għandha tingħata, fejn applikabbli, f’konformità mar-regoli u l-proċeduri stipulati fil-liġi u l-prattika tal-Unjoni u nazzjonali dwar l-informazzjoni tal-ħaddiema u r-rappreżentanti tagħhom.
|
|
Artikolu 26 8.
|
L-implimentaturi ta’ sistemi tal-IA b’riskju għoli li huma awtoritajiet pubbliċi jew istituzzjonijiet, korpi, uffiċċji jew aġenziji tal-Unjoni għandhom jikkonformaw mal-obbligi tar-reġistrazzjoni msemmija fl-Artikolu 49. Meta dawn l-implimentaturi jsibu li s-sistema tal-IA b’riskju għoli li beħsiebhom jużaw ma tkunx ġiet irreġistrata fil-bażi tad-data tal-UE msemmija fl-Artikolu 71, ma għandhomx jużaw dik is-sistema u għandhom jinfurmaw lill-fornitur jew lid-distributur.
|
|
Artikolu 26 9.
|
Fejn applikabbli, l-implimentaturi ta’ sistemi tal-IA b’riskju għoli għandhom jużaw l-informazzjoni pprovduta skont l-Artikolu 13 ta’ dan ir-Regolament biex jikkonformaw mal-obbligu tagħhom li jwettqu valutazzjoni tal-impatt fuq il-protezzjoni tad-data skont l-Artikolu 35 tar-Regolament (UE) 2016/679 jew l-Artikolu 27 tad-Direttiva (UE) 2016/680.
|
|
Artikolu 26 10.
|
Mingħajr preġudizzju għad-Direttiva (UE) 2016/680, fil-qafas ta’ investigazzjoni għat-tfittxija mmirata ta’ persuna ssuspettata jew ikkundannata li wettqet reat kriminali, l-implimentatur ta’ sistema tal-IA b’riskju għoli għall-identifikazzjoni bijometrika remota “f’ħin aktar tard” għandu jitlob awtorizzazzjoni, ex ante, jew mingħajr dewmien żejjed u mhux aktar tard minn 48 siegħa, minn awtorità ġudizzjarja jew awtorità amministrattiva li d-deċiżjoni tagħha tkun vinkolanti u soġġetta għal rieżami ġudizzjarju, għall-użu ta’ dik is-sistema, ħlief meta tintuża għall-identifikazzjoni inizjali ta’ persuna suspettata potenzjali abbażi ta’ fatti oġġettivi u verifikabbli marbuta direttament mar-reat. Kull użu għandu jkun limitat għal dak li huwa strettament meħtieġ għall-investigazzjoni ta’ reat kriminali speċifiku. Jekk l-awtorizzazzjoni mitluba skont l-ewwel subparagrafu tiġi rrifjutata, l-użu tas-sistema ta’ identifikazzjoni bijometrika remota “f’ħin aktar tard” marbuta ma’ dik l-awtorizzazzjoni mitluba għandu jitwaqqaf b’effett immedjat u d-data personali marbuta mal-użu tas-sistema tal-IA b’riskju għoli li għaliha tkun intalbet l-awtorizzazzjoni għandha titħassar. Tali sistema tal-IA b’riskju għoli għall-identifikazzjoni bijometrika remota “f’ħin aktar tard” fl-ebda każ ma għandha tintuża għal finijiet ta’ infurzar tal-liġi b’mod mhux immirat, mingħajr ebda rabta ma’ reat kriminali, proċediment kriminali, theddida ġenwina u preżenti jew ġenwina u prevedibbli ta’ reat kriminali jew it-tfittxija għal persuna nieqsa speċifika. Għandu jiġi żgurat li l-ebda deċiżjoni li tipproduċi effett legali negattiv fuq persuna ma tista’ tittieħed mill-awtoritajiet tal-infurzar tal-liġi abbażi biss tal-output ta’ dawn is-sistemi ta’ identifikazzjoni bijometrika remota “f’ħin aktar tard”. Dan il-paragrafu huwa mingħajr preġudizzju għall-Artikolu 9 tar-Regolament (UE) 2016/679 u l-Artikolu 10 tad-Direttiva (UE) 2016/680 għall-ipproċessar ta’ data bijometrika. Irrispettivament mill-fini jew mill-implimentatur, kull użu ta’ dawn is-sistemi tal-IA b’riskju għoli għandu jiġi ddokumentat fil-fajl rilevanti tal-pulizija u għandu jsir disponibbli għall-awtorità tas-sorveljanza tas-suq rilevanti u għall-awtorità nazzjonali għall-protezzjoni tad-data fuq talba, bl-esklużjoni tad-divulgazzjoni ta’ data operazzjonali sensittiva relatata mal-infurzar tal-liġi. Dan is-subparagrafu għandu jkun mingħajr preġudizzju għas-setgħat mogħtija mid-Direttiva (UE) 2016/680 lill-awtoritajiet superviżorji. L-implimentaturi għandhom jippreżentaw rapporti annwali lill-awtoritajiet rilevanti tas-sorveljanza tas-suq u tal-protezzjoni tad-data nazzjonali dwar l-użu tagħhom tas-sistemi ta’ identifikazzjoni bijometrika remota “f’ħin aktar tard”, bl-esklużjoni tad-divulgazzjoni ta’ data operazzjonali sensittiva relatata mal-infurzar tal-liġi. Ir-rapporti jistgħu jiġu aggregati biex ikopru iktar minn implimentazzjoni waħda. L-Istati Membri jistgħu jintroduċu, f’konformità mal-liġi tal-Unjoni, liġijiet aktar restrittivi dwar l-użu ta’ sistemi ta’ identifikazzjoni bijometrika remota “f’ħin aktar tard”.
|
|
Artikolu 26 11.
|
Mingħajr preġudizzju għall-Artikolu 50 ta’ dan ir-Regolament, l-implimentaturi ta’ sistemi tal-IA b’riskju għoli msemmija fl-Anness III, li jieħdu deċiżjonijiet jew jassistu fit-teħid ta’ deċiżjonijiet relatati ma’ persuni fiżiċi, għandhom jinfurmaw lill-persuni fiżiċi li huma soġġetti għall-użu tas-sistema tal-IA b’riskju għoli. Għal sistemi tal-IA b’riskju għoli użati għall-finijiet tal-infurzar tal-liġi, għandu japplika l-Artikolu 13 tad-Direttiva (UE) 2016/680.
|
|
Artikolu 26 12.
|
L-implimentaturi għandhom jikkooperaw mal-awtoritajiet kompetenti rilevanti fi kwalunkwe azzjoni li dawk l-awtoritajiet jieħdu fir-rigward ta’ sistema tal-IA b’riskju għoli biex jimplimentaw dan ir-Regolament.
|
,
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Standards relatati
2. Rekwiżiti identifikati
3. Standards relatati
Standards
| Sors |
Rekwiżit |
|
SCF
|
AI & Autonomous Technologies Deployment
Description
Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Deploy AI tools only for documented, approved purposes
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ AI deployment approval process
∙ Document intended use and technical measures
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI deployment policy
∙ Technical and organizational measures for AI deployment
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI deployment governance program
∙ Formal approval workflows
∙ Post-deployment monitoring
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI deployment governance framework
∙ Automated deployment controls
∙ Continuous monitoring
∙ Regulatory compliance
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT includes appropriate technical and organizational measures so that AAT are used in accordance with the AAT developer-provided instructions for use.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Oversight Functions Competency
Description
Mechanisms exist to ensure the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Train AI system operators on oversight responsibilities
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Training program for personnel overseeing AI systems
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI oversight training program
∙ Competency requirements for AI oversight roles
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI training and certification program for oversight personnel
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI training and certification program
∙ Role-based AI competency framework
∙ Continuous learning program
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the deployment of AAT assigns human oversight to individuals who have the necessary:
(1) Competence;
(2) Training;
(3) Authority; and
(4) Resources.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Data Relevance
Description
Mechanisms exist to ensure the input to Artificial Intelligence (AI) and Autonomous Technologies (AAT) is relevant to the intended purpose of the AAT.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Validate that inputs to AI tools are relevant before submitting
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring relevance checking of AI inputs
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI input validation policy
∙ Input relevance criteria documentation
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Input validation controls for AI systems
∙ Automated input filtering
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI input governance framework
∙ Automated input validation and filtering
∙ Data quality controls for AI pipelines
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure the input to AAT is relevant to the intended purpose of the AAT.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Irregularity Reporting
Description
Mechanisms exist to ensure serious incidents and/or irregularities associated with the deployment of Artificial Intelligence (AI) and Autonomous Technologies (AAT) are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Report serious AI incidents and irregularities to management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Incident reporting procedure for AI irregularities
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI incident and irregularity reporting policy
∙ Regulatory reporting contacts
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI incident response program with regulatory reporting integration
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI incident management platform
∙ Automated regulatory notification
∙ Legal and compliance integration
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure serious incidents and/or irregularities associated with the deployment of AAT are reported without delay to the:
(1) AAT provider;
(2) AAT importer or distributor, if applicable; and/or
(3) Local law authorities and/or governmental agency, as required.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Employees
Description
Mechanisms exist to ensure employees, including workers' representatives, are informed about Artificial Intelligence (AI) and Autonomous Technologies (AAT) deployments, prior to the use of the AAT in a production environment.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform employees of AI tools being used in their work
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Policy requiring employee notification of AI tools affecting their work
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal employee notification policy for AI deployments
∙ Communication procedures
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI transparency program for employees
∙ Works council/union notification as required
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI employee transparency framework
∙ Formal notification procedures
∙ Labor law compliance tracking
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure employees, including workers' representatives, are informed about AAT deployments, prior to the use of the AAT in a production environment.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Use Notification To Users
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inform users when AI is making or assisting decisions affecting them
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ User notification policy for AI-assisted decisions
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal user notification policy and procedures for AI decision support
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI user transparency program
∙ Automated user notifications for AI decisions
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI user transparency framework
∙ Automated disclosure mechanisms
∙ Regulatory compliance (EU AI Act, GDPR)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT that make decisions, or assist in making decisions, inform the people in a clear manner that they are:
(1) Utilizing an AAT solution; and
(2) Expected to validate the output for relevance and accuracy.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Event Logging
Description
Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous Technologies (AAT) system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Enable basic logging on AI/ML systems
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Configure event logging on AI systems
∙ Define log retention periods
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal AI event logging policy
∙ Centralized log collection
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ SIEM integration for AI system logs
∙ Defined logging standards for AI platforms
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise SIEM platform
∙ Standardized AI event logging schema
∙ Automated alerting for anomalous AI events
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Artificial Intelligence and Autonomous Technology (AAT) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are well-documented and kept current by process owners.
▪ An Artificial Intelligence Governance (AIG) team, or similar function, is appropriately staffed and supported to implement and maintain AAT domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of AI governance, risk management and compliance operations (e.g., dedicated AI governance platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure AAT system event logging capabilities at a minimum provide:
(1) Start date, start time, end date and end time for each use;
(2) Database(s) against which input data has been checked by the system;
(3) Input data for which the search has led to a match; and
(4) Identification of individual(s) involved in the verification of the results.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
AI & Autonomous Technologies Registration
Description
Mechanisms exist to maintain a current registration for Artificial Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing body, as required by statutory or regulatory requirements.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Determine whether any AI use requires registration (e.g., EU AI Act high-risk systems)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Track AI registration obligations by jurisdiction in compliance checklist
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Register high-risk AI systems with relevant authorities as required
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ AI registration compliance program
∙ Track registration requirements by jurisdiction
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise AI regulatory compliance platform
∙ Automated registration tracking
∙ EU AI Act database registration compliance
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Artificial Intelligence and Autonomous Technology (AAT) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with AAT domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ AAT-related processes are expected to follow the organization's existing processes (e.g., incident response, asset management, change control and risk assessments).
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide AAT oversight, where the Chief Information Officer (CIO), or similar function, governs technology decisions what is acceptable for AAT within the organization.
Level 2 Planned Tracked
Artificial Intelligence and Autonomous Technology (AAT) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with AAT domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with AAT domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AAT domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Artificial Intelligence (AI)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ AAT is regarded as a technology and governed by the entity's existing IT governance practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists to provide oversight of AAT-related activities. GRC functions are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to maintain a current registration for AAT with the appropriate governing body, as required by statutory or regulatory requirements.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Data Protection Impact Assessment (DPIA)
Description
Mechanisms exist to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Risk Management Program (RMP)
∙ Data Protection Impact Assessment (DPIA)
∙ Privacy Impact Assessment (PIA)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).
Level 3 Well Defined
Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to conduct a Data Protection Impact Assessment (DPIA) on Technology Assets, Applications and/or Services (TAAS) that store, process and/or transmit Personal Data (PD) to identify and remediate reasonably-expected risks.
Level 4 Quantitatively Controlled
Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|