+Embedded Technology
---+Embedded Technology Policy
---+Embedded Technology Security Program
---+Separate Operating Environments For Embedded Technologies
---+Embedded Technology Inventory Management
---+Internet of Things (IOT)
---+Operational Technology (OT)
---+Interface Security
---+Embedded Technology Configuration Monitoring
---+Prevent Alterations
---+Embedded Technology Maintenance
---+Resilience To Outages
---+Power Level Monitoring
---+Embedded Technology Reviews
---+Message Queuing Telemetry Transport (MQTT) Security
---+Remote Management of Embedded Technologies
---+Restrict Communications
---+Authorized Communications
---+Operating Environment Certification
---+Safety Assessment
---+Certificate-Based Authentication
---+Chip-To-Cloud Security
---+Real-Time Operating System (RTOS) Security
---+Safe Operations
---+Proximity Sensor
---+Safety Instrumented System (SIS)
---+Safety Instrumented Function (SIF)
---+Safety Integrity Level (SIL)
|
Embedded Technology
Security, Compliance & Resilience (SCR) PrinciplesApply risk-based security, compliance and resilience practices to embedded technologies where compromise or misuse could create operational, safety and/or data protection impacts.
Principle IntentOrganizations develop, deploy, harden, monitor and maintain embedded technologies, including IoT and Operational Technology (OT), with safeguards for hardware, firmware, software, communications, service protocols and safety-related dependencies.
1. Ħarsa ġenerali
| Titlu |
Standard |
|
Embedded Technology Policy
|
Description
Mechanisms exist to establish a formal, documented embedded technology policy that:
(1) Conveys executive management's intent;
(2) Provides organizational direction and expected behaviors;
(3) Is reviewed at least annually; and
(4) Is updated, as necessary, to adapt to evolving risks, threats and other changes that affect the organization.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Executive-approved written policy with documented annual review
∙ Policy acknowledgement tracking (e.g., HR onboarding records)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Documented annual policy review with version control
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ GRC solution (e.g., SCFConnect, Cyturus, SureCloud, SimpleRisk, Ignyte, ZenGRC, Galvanize, MetricStream, Archer, etc.) for policy lifecycle management
∙ Policy governance committee with formal annual review and approval workflow
∙ Automated policy attestation and acknowledgement tracking
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Steering committee
∙ ComplianceForge - Security, Compliance & Resilience Program (SCRP) (https://complianceforge.com)
∙ Enterprise GRC platform (e.g., Cyturus, Archer, MetricStream, ServiceNow IRM) for policy lifecycle management
∙ Automated policy attestation, exception tracking and change history
∙ Annual executive approval and board-level reporting
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Embedded Technology Security Program
|
Description
Mechanisms exist to facilitate the implementation of embedded technology controls.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ IT Asset Management (ITAM) program
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ IT Asset Management (ITAM) program
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ IT Asset Management (ITAM) program
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IT Asset Management (ITAM) program
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ IT Asset Management (ITAM) program
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to facilitate the implementation of embedded technology controls.
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Separate Operating Environments For Embedded Technologies
|
Description
Mechanisms exist to logically or physically separate embedded technologies from organizational Information Technology (IT) networks.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Separate Wi-Fi network or VLAN for IoT devices (e.g., cameras, printers, smart devices)
∙ Firewall rules blocking IoT-to-workstation traffic
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Dedicated VLAN(s) for IoT/OT with firewall rules
∙ Network Access Control (NAC) or MAC filtering for embedded devices
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Network segmentation for IoT/OT with firewall enforcement
∙ Network Access Control (NAC) (e.g., Cisco ISE, Aruba ClearPass, FortiNAC)
∙ Industrial DMZ for OT environments
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Purdue model-based OT segmentation with industrial DMZ
∙ OT-aware firewalls (e.g., Fortinet, Palo Alto, Cisco)
∙ OT visibility platform (e.g., Claroty, Nozomi, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise OT/IoT segmentation program aligned with ISA/IEC 62443 zones and conduits
∙ OT-aware firewalls and unidirectional gateways where required
∙ OT visibility and detection platform (e.g., Claroty, Nozomi, Dragos, Armis)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Embedded Technology Inventory Management
|
Description
Mechanisms exist to augment organizational IT Asset Management (ITAM) processes for Operational Technology (OT) and Internet of Things (IoT) devices with:
(1) Passive network monitoring; and
(2) Periodic physical inspections.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Manual inventory of IoT devices (spreadsheet)
∙ Annual walk-through to identify connected devices
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ IoT/OT devices tracked in the asset inventory
∙ Router/firewall device lists reviewed periodically
∙ Annual physical inspection
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Passive discovery for IoT/OT (e.g., runZero, Armis, Lansweeper OT)
∙ Embedded devices recorded in the CMDB
∙ Annual physical inspection with reconciliation
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ OT/IoT visibility platform with passive monitoring (e.g., Claroty, Nozomi, Armis)
∙ CMDB integration for embedded devices
∙ Scheduled physical inspections by site
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise OT/IoT asset visibility platform (e.g., Claroty, Nozomi, Dragos, Armis)
∙ Automated CMDB reconciliation for embedded devices
∙ Formal physical inspection program across facilities
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Internet of Things (IOT)
|
Description
Mechanisms exist to proactively manage the security, compliance and resilience risks associated with Internet of Things (IoT).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Special baselines for embedded technologies configurations are created for higher-risk environments.
▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to proactively manage the security, compliance and resilience risks associated with Internet of Things (IoT).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Operational Technology (OT)
|
Description
Mechanisms exist to proactively manage the security, compliance and resilience risks associated with Operational Technology (OT).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Data classification program
∙ Sensitive data inventories
∙ Data Flow Diagram (DFD)
∙ System Security & Privacy Plan (SSPP)
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Special baselines for embedded technologies configurations are created for higher-risk environments.
▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to proactively manage the security, compliance and resilience risks associated with Operational Technology (OT).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Interface Security
|
Description
Mechanisms exist to protect embedded devices against unauthorized use of the physical factory diagnostic and test interface(s).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Special baselines for embedded technologies configurations are created for higher-risk environments.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to protect embedded devices against unauthorized use of the physical factory diagnostic and test interface(s).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Embedded Technology Configuration Monitoring
|
Description
Mechanisms exist to generate log entries on embedded devices when configuration changes or attempts to access interfaces are detected.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inventory embedded devices and document security settings
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Embedded device inventory
∙ Default credential change policy
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Embedded/IoT device security program
∙ Network segmentation for IoT
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT/OT security program
∙ Network segmentation
∙ IoT security platform (e.g., Claroty, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)
∙ Zero-trust IoT architecture
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to generate log entries on embedded devices when configuration changes or attempts to access interfaces are detected.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Prevent Alterations
|
Description
Mechanisms exist to protect embedded devices by preventing the unauthorized installation and execution of software.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to protect embedded devices by preventing the unauthorized installation and execution of software.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Embedded Technology Maintenance
|
Description
Mechanisms exist to securely update software and upgrade functionality on embedded devices.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
▪ Unauthorized configuration changes to embedded technologies are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to securely update software and upgrade functionality on embedded devices.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Resilience To Outages
|
Description
Mechanisms exist to configure embedded technology to be resilient to data network and power outages.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inventory embedded devices and document security settings
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Embedded device inventory
∙ Default credential change policy
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Embedded/IoT device security program
∙ Network segmentation for IoT
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT/OT security program
∙ Network segmentation
∙ IoT security platform (e.g., Claroty, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)
∙ Zero-trust IoT architecture
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Embedded technologies (e.g., IoT and OT) are governed according to the same processes used for generic Technology Assets, Applications and/or Services (TAAS), where no formal, dedicated embedded technology governance process exists.
▪ Business stakeholders and process owners are expected to take the initiative to work with IT and/or cybersecurity personnel to ensure applicable statutory, regulatory and/or contractual obligations are properly addressed, including the storage, transmission and processing of sensitive/regulated data.
▪ Secure Baseline Configurations (SBCs) protect embedded technologies commensurate with the criticality of the device and/or sensitivity of the data, in accordance with applicable laws, regulations and frameworks.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to configure embedded technology to be resilient to data network and power outages.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Power Level Monitoring
|
Description
Automated mechanisms exist to monitor the power levels of embedded technologies for decreased or excessive power usage, including battery drainage, to investigate for device tampering.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inventory embedded devices and document security settings
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Embedded device inventory
∙ Default credential change policy
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Embedded/IoT device security program
∙ Network segmentation for IoT
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT/OT security program
∙ Network segmentation
∙ IoT security platform (e.g., Claroty, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)
∙ Zero-trust IoT architecture
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to automatically monitor the power levels of embedded technologies for decreased or excessive power usage, including battery drainage, to investigate for device tampering.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Embedded Technology Reviews
|
Description
Mechanisms exist to perform evaluations of deployed embedded technologies as needed, or at least on an annual basis, to ensure that necessary updates to mitigate the risks associated with legacy embedded technologies are identified and implemented.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Configuration Management (CM) program
∙ Technology maintenance program
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
∙ Configuration Management Database (CMDB)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Configuration Management (CM) program
∙ Technology maintenance program
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
∙ Configuration Management Database (CMDB)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Configuration Management (CM) program
∙ Technology maintenance program
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
∙ Configuration Management Database (CMDB)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Configuration Management (CM) program
∙ Technology maintenance program
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
∙ Configuration Management Database (CMDB)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Configuration Management (CM) program
∙ Technology maintenance program
∙ Technology maintenance program
∙ Vulnerability & Patch Management Program (VPMP)
∙ Configuration Management Database (CMDB)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to perform evaluations of deployed embedded technologies as needed, or at least on an annual basis, to ensure that necessary updates to mitigate the risks associated with legacy embedded technologies are identified and implemented.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Message Queuing Telemetry Transport (MQTT) Security
|
Description
Mechanisms exist to enforce the security of Message Queuing Telemetry Transport (MQTT) traffic.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to enforce the security of Message Queuing Telemetry Transport (MQTT) traffic.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Remote Management of Embedded Technologies
|
Description
Mechanisms exist to restrict remote management of embedded technologies by:
(1) Allowing access only when needed;
(2) Eliminating "always on" connections; and
(3) Requiring strong authentication.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Disable remote management on IoT devices unless needed
∙ Change default credentials and enable MFA where supported
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ VPN with MFA for remote device management
∙ Remote access disabled by default and enabled on request
∙ Vendor remote access approved per session
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Jump host / bastion for OT/IoT management with MFA
∙ Time-limited vendor access
∙ Session logging
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure remote access for OT (e.g., Claroty SRA, Cyolo, BeyondTrust)
∙ Privileged Access Management (PAM) session brokering and recording
∙ No persistent vendor connections
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise OT secure remote access platform (e.g., Claroty SRA, Dragos, Cyolo)
∙ PAM with session recording and just-in-time access
∙ Continuous monitoring of remote sessions in the SOC
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Restrict Communications
|
Description
Mechanisms exist to require embedded technologies to initiate all communications and drop new, incoming communications.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to require embedded technologies to initiate all communications and drop new, incoming communications.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Authorized Communications
|
Description
Mechanisms exist to restrict embedded technologies to communicate only with authorized peers and service endpoints.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ Network segmentation (logical and/or physical)
∙ Access Control Lists (ACL)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to restrict embedded technologies to communicate only with authorized peers and service endpoints.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Operating Environment Certification
|
Description
Mechanisms exist to determine if embedded technologies are certified for secure use in the proposed operating environment.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inventory embedded devices and document security settings
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Embedded device inventory
∙ Default credential change policy
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Embedded/IoT device security program
∙ Network segmentation for IoT
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT/OT security program
∙ Network segmentation
∙ IoT security platform (e.g., Claroty, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)
∙ Zero-trust IoT architecture
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to determine if embedded technologies are certified for secure use in the proposed operating environment.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Safety Assessment
|
Description
Mechanisms exist to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ IoT / OT safety assessment
∙ Data Protection Impact Assessment (DPIA)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ IoT / OT safety assessment
∙ Data Protection Impact Assessment (DPIA)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ IoT / OT safety assessment
∙ Data Protection Impact Assessment (DPIA)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT / OT safety assessment
∙ Data Protection Impact Assessment (DPIA)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ IoT / OT safety assessment
∙ Data Protection Impact Assessment (DPIA)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to evaluate the safety aspects of embedded technologies via a fault tree analysis, or similar method, to determine possible consequences of misuse, misconfiguration and/or failure.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Certificate-Based Authentication
|
Description
Mechanisms exist to enforce certificate-based authentication for embedded technologies (e.g., IoT and OT) and their supporting services.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Inventory embedded devices and document security settings
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Embedded device inventory
∙ Default credential change policy
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Embedded/IoT device security program
∙ Network segmentation for IoT
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ IoT/OT security program
∙ Network segmentation
∙ IoT security platform (e.g., Claroty, Armis)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise IoT/OT security platform (e.g., Claroty, Armis, Dragos)
∙ Zero-trust IoT architecture
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to enforce certificate-based authentication for embedded technologies (e.g., IoT and OT) and their supporting services.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Chip-To-Cloud Security
|
Description
Mechanisms exist to implement embedded technologies that utilize pre-provisioned cloud trust anchors to support secure bootstrap and Zero Touch Provisioning (ZTP).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to implement embedded technologies that utilize pre-provisioned cloud trust anchors to support secure bootstrap and Zero Touch Provisioning (ZTP).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Real-Time Operating System (RTOS) Security
|
Description
Mechanisms exist to ensure embedded technologies utilize a securely configured Real-Time Operating System (RTOS).
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to ensure embedded technologies utilize a securely configured Real-Time Operating System (RTOS).
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Safe Operations
|
Description
Mechanisms exist to continuously validate autonomous systems that trigger an automatic state change when safe operation is no longer assured.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Secure Baseline Configurations (SBC)
∙ IT Asset Management (ITAM) program
∙ Configuration Management (CM) program
∙ Product / project management
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to continuously validate autonomous systems that trigger an automatic state change when safe operation is no longer assured.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Proximity Sensor
|
Description
Automated mechanisms exist to monitor physical proximity to robotic or autonomous platforms to reduce applied force or stop the operation when sensors indicate a potentially dangerous scenario.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Document and protect physical assets at remote/alternate sites
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Physical security policy for remote/alternate work sites
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Formal remote site physical security policy
∙ Controls commensurate with risks
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Enterprise remote site physical security program
∙ Security assessments for remote locations
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise remote site security program
∙ Standardized physical security controls
∙ Regular remote site audits
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.
Level 2 Planned Tracked
SCR-CMM Level 2 criteria definitions are not available for this control:
▪ A reasonable person would conclude a well-defined and standardized process is required.
▪ At this level of maturity, the “requirements-driven” nature of performing the control is focused on a localized and/or regionalized implementation, not uniform and consistent across the organization.
▪ Requirements are narrowly scoped for applicability and are primarily derived from compliance obligations (e.g., laws, regulations and contracts).
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to automatically monitor physical proximity to robotic or autonomous platforms to reduce applied force or stop the operation when sensors indicate a potentially dangerous scenario.
Level 4 Quantitatively Controlled
Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Safety Instrumented System (SIS)
|
Description
Automated mechanisms exist to monitor and control hazardous processes to reduce the potential negative consequences of hazardous events.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Not applicable unless hazardous processes are operated
∙ Vendor-provided safety systems maintained per manufacturer guidance
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Vendor-provided SIS maintained under service agreement
∙ SIS isolated from business networks
∙ Documented safety requirements
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Safety Instrumented System (SIS) independent from BPCS
∙ Segmentation of safety networks
∙ Functional safety management per IEC 61511
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Functional safety program (IEC 61508 / IEC 61511)
∙ SIS with independent safety network and access control
∙ OT security monitoring covering safety systems (e.g., Claroty, Nozomi, Dragos)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise functional safety management system (IEC 61508 / IEC 61511)
∙ Certified SIS platforms with independent safety networks
∙ Integrated OT cybersecurity and process safety governance
∙ Periodic proof testing and cybersecurity assessment of SIS
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Safety Instrumented Function (SIF)
|
Description
Automated mechanisms exist within a Safety Instrumented System (SIS) to execute predetermined actions upon detection of a potentially hazardous event.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Not applicable unless hazardous processes are operated
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Vendor-defined safety functions documented and maintained
∙ Safety logic changes restricted to authorized personnel
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Safety Requirements Specification (SRS) per SIF
∙ Proof testing schedule
∙ Change control for safety logic
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Functional safety lifecycle management (IEC 61511)
∙ SIF configuration integrity monitoring
∙ Bypass management procedures
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise functional safety management with SIF lifecycle tooling (e.g., exSILentia)
∙ Integrity monitoring and change control for safety logic solvers
∙ Formal bypass and override governance
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
|
Safety Integrity Level (SIL)
|
Description
Mechanisms exist to assign a Safety Integrity Level (SIL) that measures the performance and reliability with which a Safety Instrumented Function (SIF) reduces risk
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Not applicable unless hazardous processes are operated
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Vendor-provided safety documentation reviewed
∙ Safety requirements documented
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Hazard and risk analysis (e.g., HAZOP, LOPA) with SIL assignment
∙ SIL verification calculations
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Functional safety program with documented SIL determination and verification (IEC 61511)
∙ Cybersecurity risk assessment of SIS (ISA/IEC 62443-3-2)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Enterprise functional safety management with SIL lifecycle tooling
∙ Integrated process safety and OT cybersecurity risk assessment
∙ Independent functional safety assessment
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Embedded Technology (EMB) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with EMB domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Embedded technology management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Embedded technologies (e.g., Operational Technology (OT) and Internet of Things (IoT) are managed in the same manner as any other technology asset.
Level 2 Planned Tracked
Embedded Technology (EMB) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Embedded technology-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Embedded technology management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
Level 3 Well Defined
Embedded Technology (EMB) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with EMB domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with EMB domain capabilities are well-documented and kept current by process owners.
▪ An embedded systems team, or similar function, is appropriately staffed and supported to implement and maintain EMB domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of embedded technology operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with EMB domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
Level 4 Quantitatively Controlled
Embedded Technology (EMB) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
|
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
- Secure Controls Framework -
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/
Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.
|