+Artikolu 31 Deżinjazzjoni ta’ fornituri terzi kritiċi ta’ servizzi tal-ICT
---+Artikolu 31 1
---+Artikolu 31 2
---+Artikolu 31 3
---+Artikolu 31 4
---+Artikolu 31 5
---+Artikolu 31 6
---+Artikolu 31 7
---+Artikolu 31 8
---+Artikolu 31 9
---+Artikolu 31 10
---+Artikolu 31 11
---+Artikolu 31 12
---+Artikolu 31 13
|
Artikolu 31 Deżinjazzjoni ta’ fornituri terzi kritiċi ta’ servizzi tal-ICT
-
1. Ħarsa ġenerali
| Titlu |
Regolamentazzjoni |
|
Artikolu 31 1
|
1. L-ASE, permezz tal-Kumitat Konġunt u fuq rakkomandazzjoni mill-Forum ta’ Sorveljanza stabbilit skont l-Artikolu 32(1) għandhom:
|
(a)
|
jiddeżinjaw il-fornituri terzi ta’ servizzi tal-ICT li huma kritiċi għall-entitajiet finanzjarji, wara valutazzjoni li tqis l-kriterji speċifikati fil-paragrafu 2;
|
|
(b)
|
jaħtru bħala sorveljant ewlieni għal kull fornitur terz ta’ servizzi tal-ICT l-Awtorità Superviżorja Ewropea responsabbli, f’konformità mar-Regolamenti (UE) Nru 1093/2010, (UE) Nru 1094/2010 jew (UE) Nru 1095/2010, għall-entitajiet finanzjarji li t-total tal-assi li flimkien ikollhom l-akbar sehem tal-assi totali mill-valur tal-assi totali tal-entitajiet finanzjarji kollha li jużaw is-servizzi tal-fornitur terz kritiku ta’ servizzi tal-ICT rilevanti, kif jixhdu l-karti bilanċjali individwali ta’ dawk l-entitajiet finazjarji magħduda flimkien.
|
|
|
Artikolu 31 2
|
2. Id-deżinjazzjoni msemmija fil-paragrafu 1, il-punt (a), għandha tkun ibbażata fuq il-kriterji kollha li ġejjin fir-rigward tas-servizzi tal-ICT ipprovduti mill- fornitur terz ta’ servizzi tal-ICT:
|
(a)
|
l-impatt sistemiku fuq l-istabbiltà, il-kontinwità jew il-kwalità tal-forniment ta’ servizzi finanzjarji fil-każ li l-fornitur terz ta’ servizzi tal-ICT rilevanti jkun affrontat minn nuqqas operattiv fuq skala kbira li jipprovdi s-servizzi tiegħu, b’kont meħud tal-għadd ta’ entitajiet finanzjarji u l-valur totali tal-assi li lilhom jipprovdi servizzi l-fornitur terz rilevanti ta’ servizzi tal-ICT;
|
|
(b)
|
in-natura sistemika jew l-importanza tal-entitajiet finanzjarji li jiddependu fuq il-fornitur terz ta’ servizzi tal-ICT rilevanti, ivvalutata skont il-parametri li ġejjin:
|
(i)
|
l-għadd ta’ istituzzjonijiet globali sistemikament importanti (G-SIIs) jew istituzzjonijiet oħra sistematikament importanti (O-SIIs) li jiddependu fuq il-fornitur terz rispettiv ta’ servizzi tal-ICT;
|
|
(ii)
|
l-interdipendenza bejn il-G-SIIs jew l-O-SIIs imsemmija fil-punt (i) u entitajiet finanzjarji oħra, inkluż sitwazzjonijiet fejn il-G-SIIs jew l-O-SIIs jipprovdu servizzi ta’ infrastruttura finanzjarja lil entitajiet finanzjarji oħra;
|
|
|
(c)
|
id-dipendenza tal-entitajiet finanzjarji fuq is-servizzi pprovduti mill-fornitur terz ta’ servizzi tal-ICT b’rabta mal-funzjonijiet kritiċi jew importanti ta’ entitajiet finanzjarji li fl-aħħar mill-aħħar jinvolvu l-istess fornitur terz ta’ servizzi tal-ICT, irrispettivament minn jekk l-entitajiet finanzjarji jiddependux fuq dawk is-servizzi direttament jew indirettament, permezz ta’ arranġamenti ta’ sottokuntrattar;
|
|
(d)
|
il-grad ta’ sostitwibbiltà tal-fornitur terz ta’ servizzi tal-ICT, filwaqt li jitqiesu l-parametri li ġejjin:
|
(i)
|
in-nuqqas ta’ alternattivi reali, anki parzjali, minħabba l-għadd limitat ta’ fornituri terzi ta’ servizzi tal-ICT attivi f’suq speċifiku, jew is-sehem mis-suq tal-fornitur terz rilevanti ta’ servizzi tal-ICT, jew il-kumplessità teknika jew is-sofistikazzjoni involuta, inkluż b’rabta ma’ kwalunkwe teknoloġija proprjetarja, jew il-karatteristiċi speċifiċi tal-organizzazzjoni jew l-attività tal-fornitur terz ta’ servizzi tal-ICT;
|
|
(ii)
|
id-diffikultajiet rigward il-migrazzjoni parzjali jew sħiħa tad-data rilevanti u tax-xogħol mill-fornitur terz rilevanti ta’ servizzi tal-ICT lil fornitur terz ieħor ta’ servizzi tal-ICT, minħabba jew il-kostijiet finanzjarji sinifikanti, iż-żmien jew tip ieħor ta’ riżorsi li jista’ jinvolvi l-proċess ta’ migrazzjoni, jew minħabba żieda fir-riskju tal-ICT jew ta’ riskji operazzjonali oħrajn li għalihom tista’ tkun esposta l-entità finanzjarja permezz ta’ tali migrazzjoni.
|
|
|
|
Artikolu 31 3
|
3. Fejn il-fornitur terz ta’ servizzi tal-ICT jappartjeni għal grupp, il-kriterji msemmija fil-paragrafu 2 għandhom jitqiesu fir-rigward tas-servizzi tal-ICT ipprovduti mill-grupp kollu kemm hu.
|
|
Artikolu 31 4
|
4. Il-fornituri terzi kritiċi ta’ servizzi tal-ICT li huma parti minn grupp għandhom jaħtru persuna ġuridika waħda bħala punt ta’ koordinazzjoni biex jiżguraw rappreżentanza u komunikazzjoni adegwati mas-sorveljant ewlieni.
|
|
Artikolu 31 5
|
5. Is-sorveljant ewlieni għandu jinnotifika lill-fornitur terz ta’ servizzi tal-ICT dwar l-eżitu tal-valutazzjoni li twassal għad-deżinjazzjoni msemmija fil-paragrafu 1, il-punt (a). Fi żmien 6 ġimgħat mid-data tan-notifika, il-fornitur terz ta’ servizzi tal-ICT jista’ jippreżenta dikjarazzjoni motivata bi kwalunkwe informazzjoni rilevanti għall-finijiet tal-valutazzjoni lis-sorveljant ewlieni. Is-sorveljant ewlieni għandu jikkunsidra d-dikjarazzjoni motivata u jista’ jitlob li tiġi ppreżentata informazzjoni addizzjonali fi żmien 30 jum kalendarju mill-wasla ta’ tali dikjarazzjoni.
Wara d-deżinjazzjoni ta’ fornitur terz ta’ servizzi tal-ICT bħala kritiku, l-ASE, permezz tal-Kumitat Konġunt, għandhom jinnotifikaw lill-fornitur terz ta’ servizzi tal-ICT b’din id-deżinjazzjoni u bid-data minn meta ser jibdew jkunu effettivament soġġetti għal attivitajiet ta’ sorveljanza. Dik id-data tal-bidu ma għandhiex tkun aktar tard minn xahar wara n-notifika. Il-fornitur terz ta’ servizzi tal-ICT għandu jinnotifika lill-entitajiet finanzjarji li lilhom jipprovdi servizzi dwar id-deżinjazzjoni tagħhom bħala kritika.
|
|
Artikolu 31 6
|
6. Il-Kummissjoni tingħata s-setgħa tadotta att delegat f’konformità mal-Artikolu 57 biex tissupplimenta dan ir-Regolament billi tispeċifika aktar il-kriterji msemmija fil-paragrafu 2 ta’ dan l-Artikolu, sas-17 ta’ Lulju 2024.
|
|
Artikolu 31 7
|
7. Id- deżinjazzjoni msemmija fil-paragrafu 1, il-punt (a), ma għandhiex tintuża qabel ma l-Kummissjoni tkun adottat att delegat f’konformità mal-paragrafu 6.
|
|
Artikolu 31 8
|
8. Id-deżinjazzjoni msemmija fil-paragrafu 1, il-punt (a), ma għandhiex tapplika għal dawn li ġejjin:
|
(i)
|
entitajiet finanzjarji li jipprovdu servizzi tal-ICT lil entitajiet finanzjarji oħra;
|
|
(ii)
|
fornituri terzi ta’ servizzi tal-ICT li huma soġġetti għal oqfsa ta’ sorveljanza stabbiliti għall-finijiet ta’ appoġġ għall-kompiti msemmija fl-Artikolu 127(2) tat-Trattat dwar il-Funzjonament tal-Unjoni Ewropea;
|
|
(iii)
|
fornituri intragrupp ta’ servizzi tal-ICT;
|
|
(iv)
|
fornituri terzi ta’ servizzi tal-ICT li jipprovdu servizzi tal-ICT fi Stat Membru wieħed biss lil entitajiet finanzjarji li huma attivi biss f’dak l-Istat Membru.
|
|
|
Artikolu 31 9
|
9. L-AS, permezz tal-Kumitat Konġunt, għandhom jistabbilixxu, jippubblikaw u jaġġornaw kull sena l-lista ta’ fornituri terzi kritiċi ta’ servizzi tal-ICT fil-livell tal-Unjoni.
|
|
Artikolu 31 10
|
10. Għall-finijiet tal-paragrafu 1, il-punt (a), l-awtoritajiet kompetenti għandhom, fuq bażi annwali u aggregata, jibagħtu r-rapporti msemmija fl-Artikolu 28(3), it-tielet subparagrafu, lill-Forum ta’ Sorveljanza stabbilit skont l-Artikolu 32. Il-Forum ta’ Sorveljanza għandu jivvaluta d-dipendenzi ta’ entitajiet finanzjarji fuq partijiet terzi tal-ICT abbażi tal-informazzjoni li jirċievu mill-awtoritajiet kompetenti.
|
|
Artikolu 31 11
|
11. Il-fornituri terz ta’ servizzi tal-ICT li mhumiex fil-lista msemmija fil-paragrafu 9 jistgħu jitolbu li jiġu iddeżinjati bħala kritiċi skont il-paragrafu 1, il-punt (a).
Għall-fini tal-ewwel subparagrafu, il-fornitur terz ta’ servizzi tal-ICT għandu jippreżenta applikazzjoni motivata lill-EBA, lill-ESMA jew lill-EIOPA, li, permezz tal-Kumitat Konġunt, għandhom jiddeċiedu jekk jiddeżinjawx lil dak il-fornitur terz ta’ servizzi tal-ICT bħala kritiku skont il-paragrafu 1, il-punt (a).
Id-deċiżjoni msemmija fit-tieni subparagrafu għandha tiġi adottata u nnotifikata lill-fornitur terz ta’ servizzi tal-ICT fi żmien 6 xhur minn meta tasal l-applikazzjoni.
|
|
Artikolu 31 12
|
12. L-entitajiet finanzjarji għandhom jużaw biss is-servizzi ta’ fornitur terz ta’ servizzi tal-ICT stabbilit f’pajjiż terz u li jkun ġie ddeżinjat bħala kritiku f’konformità mal-paragrafu 1, il-punt (a), jekk dan ikun stabbilixxa sussidjarja fl-Unjoni fi żmien 12-il xahar wara d-deżinjazzjoni.
|
|
Artikolu 31 13
|
13. Il-fornitur terz kritiku ta’ servizzi tal-ICT imsemmi fil-paragrafu 12 għandu jinnotifika lis-sorveljant ewlieni bi kwalunkwe bidla fl-istruttura tal-maniġment tas-sussidjarja stabbilita fl-Unjoni.
|
,
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Standards relatati
2. Rekwiżiti identifikati
3. Standards relatati
Standards
| Sors |
Rekwiżit |
|
SCF
|
Contacts With Authorities
Description
Mechanisms exist to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Documented list of law enforcement and regulatory contacts (FBI, CISA, state AG)
∙ MS-ISAC free membership (https://www.cisecurity.org/ms-isac)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Documented contacts with FBI Cyber Division, CISA, and relevant regulators
∙ MS-ISAC or sector-specific ISAC membership
∙ Pre-established law enforcement liaisons for incident response
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Integrated Security Incident Response Team (ISIRT) with defined authority contacts
∙ CISA Cyber Liaison and FBI Cyber Division contacts
∙ Sector ISAC membership (e.g., FS-ISAC, H-ISAC, E-ISAC)
∙ Regulatory notification contact list (e.g., FTC, OCR, state regulators)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Integrated Security Incident Response Team (ISIRT) with pre-established authority relationships
∙ Formal engagement with law enforcement (FBI, USSS, CISA)
∙ Sector ISAC active membership with information sharing participation
∙ Regulatory breach notification contacts and documented procedures
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Dedicated government liaison program (FBI, CISA, NSA, sector regulators)
∙ Active ISAC membership with classified threat briefing access (where applicable)
∙ Pre-established breach notification workflows for all applicable regulators
∙ Integrated Security Incident Response Team (ISIRT) with 24/7 law enforcement contact protocols
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Cybersecurity & Data Protection Governance (GOV) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with GOV domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Governance-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT/cybersecurity personnel.
▪ Cybersecurity and data protection governance is informally assigned as an additional duty to existing IT/cybersecurity personnel.
▪ Cybersecurity personnel identify and maintain contact information for local and national law enforcement (e.g., FBI field office) in case of cybersecurity incidents that require law enforcement involvement.
Level 2 Planned Tracked
Cybersecurity & Data Protection Governance (GOV) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with GOV domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Governance-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ No formal Governance, Risk & Compliance (GRC) team exists. GRC roles are assigned to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Cybersecurity & Data Protection Governance (GOV) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with GOV domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with GOV domain capabilities are well-documented and kept current by process owners.
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain GOV domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ An implemented and operational capability exists to identify and document appropriate contacts with relevant law enforcement and regulatory bodies.
Level 4 Quantitatively Controlled
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Cybersecurity & Data Protection Governance (GOV) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
▪ Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions via Artificial Intelligence (AI) or Machine Learning (ML) technologies.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
SCF
|
Third-Party Management
Description
Mechanisms exist to facilitate the implementation of third-party management controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Cybersecurity Supply Chain Risk Management (C-SCRM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Third-Party Management (TPM) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with TPM domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Third-party management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ No centralized inventory of External Service Providers (ESP) is maintained.
▪ ESP are not formally managed according to criticality.
Level 2 Planned Tracked
Third-Party Management (TPM) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Third-party management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Third-Party Management (TPM) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TPM domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TPM domain capabilities are well-documented and kept current by process owners.
▪ A procurement team, or similar function, is appropriately staffed and supported to implement and maintain TPM domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of third-party management operations (e.g., TPRM risk management solution and vendor management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TPM domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of third-party management controls.
Level 4 Quantitatively Controlled
Third-Party Management (TPM) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|