+Risk Identification
|
Risk Identification
Description
Mechanisms exist to identify and document risks, both internal and external.
Possible Solutions & Considerations
Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2
∙ Risk Management Program (RMP)
Small Business (10-49 staff) / BLS Firm Size Classes 3-4
∙ Risk Management Program (RMP)
Medium Business (50-249 staff) / BLS Firm Size Classes 5-6
∙ Risk Management Program (RMP)
Large Business (250-999 staff) / BLS Firm Size Classes 7-8
∙ Risk Management Program (RMP)
Enterprise (> 1,000 staff) / BLS Firm Size Class 9
∙ Risk Management Program (RMP)
SCR-CMM
Level 0 Not Performed
Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.
Level 1 Performed Informally
Risk Management (RSK) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with RSK domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Risk management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to identify, assess, remediate and report on risk.
▪ Risk management processes (e.g., risk assessments) focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ Data/process owners are expected to self-manage risks associated with their Technology Assets, Applications, Services and/or Data (TAASD), based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
Level 2 Planned Tracked
Risk Management (RSK) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Risk management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Risk management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Risk management processes (e.g., risk assessments) and technologies focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
▪ IT and/or cybersecurity personnel implement and maintain a form of Risk Management Program (RMP) that provides operational guidance on how risk is identified, assessed, remediated and reported.
▪ Data/process owners are expected to self-manage risks associated with their systems, applications, services and data, based on the organization's published policies and standards, including the identification, remediation and reporting of risks.
▪ Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).
Level 3 Well Defined
Risk Management (RSK) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with RSK domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with RSK domain capabilities are well-documented and kept current by process owners.
▪ A risk management team, or similar function, is appropriately staffed and supported to implement and maintain RSK domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of risk management operations (e.g., risk management solution, GRC platform and TPRM tool).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with RSK domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to identify and document risks, both internal and external.
Level 4 Quantitatively Controlled
Risk Management (RSK) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.
Level 5 Continuously Improving
Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
|
EULAW
|
Artikolu 28 1
1. L-entitajiet finanzjarji għandhom jimmaniġġaw ir-riskju relatat mal-ICT minn partijiet terzi bħala komponent integrali tar-riskju tal-ICT fil-qafas tal-ġestjoni tar-riskju tal-ICT tagħhom kif imsemmi fl-Artikolu 6(1), u f’konformità mal-prinċipji li ġejjin:
|
(a)
|
l-entitajiet finanzjarji li għandhom fis-seħħ arranġamenti kuntrattwali għall-użu tas-servizzi tal-ICT biex iwettqu l-operat tagħhom għandhom, f’kull ħin, jibqgħu kompletament responsabbli għall-konformità mal-obbligi kollha u jwettquhom, skont dan ir-Regolament u l-liġi applikabbli dwar is-servizzi finanzjarji;
|
|
(b)
|
il-ġestjoni mill-entitajiet finanzjarji tar-riskju relatat mal-ICT minn partijiet terzi għandha tiġi implimentata fid-dawl tal-prinċipju tal-proporzjonalità, filwaqt li jitqiesu:
|
(i)
|
in-natura, l-iskala, il-kumplessità u l-importanza tad-dipendenzi relatati mal-ICT,
|
|
(ii)
|
ir-riskji li jirriżultaw minn arranġamenti kuntrattwali dwar l-użu ta’ servizzi tal-ICT konklużi ma’ fornituri terzi ta’ servizzi tal-ICT, b’kont meħud tal-kritikalità jew tal-importanza tas-servizz, il-proċess jew il-funzjoni rispettivi, u l-impatt potenzjali fuq il-kontinwità u fuq id-disponibbiltà tas-servizzi u l-attivitajiet finanzjarji, fil-livell individwali u fil-livell ta’ grupp.
|
|
|
|
EULAW
|
Artikolu 28 2
2. Bħala parti mill-qafas ta’ ġestjoni tar-riskju tal-ICT tagħhom, l-entitajiet finanzjarji, għajr dawk l-entitajiet imsemmija fl-Artikolu 16(1), l-ewwel subparagrafu u għajr il-mikrointrapriżi, għandhom jadottaw, u jirrieżaminaw b’mod regolari, strateġija dwar ir-riskju relatat mal-ICT minn partijiet terzi, waqt li jqisu l-istrateġija ta’ diversi bejjiegħa msemmija fl-Artikolu 6(9), fejn applikabbli. L-istrateġija dwar ir-riskju relatat mal-ICT minn partijiet terzi għandha tinkludi politika dwar l-użu ta’ servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti pprovduti minn fornituri terzi ta’ servizzi tal-ICT u għandha tapplika fuq bażi individwali u, fejn rilevanti, fuq bażi subkonsolidata u konsolidata. Il-korp maniġerjali għandu, abbażi ta’ valutazzjoni tal-profil tar-riskju ġenerali tal-entità finanzjarja u l-iskala u l-kumplessità tas-servizzi tan-negozju, jirrieżamina regolarment ir-riskji identifikati fir-rigward tal-arranġamenti kuntrattwali dwar l-użu tas-servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti.
|
|
EULAW
|
Artikolu 28 3
3. Bħala parti mill-qafas ta’ ġestjoni tar-riskju tal-ICT tagħhom, l-entitajiet finanzjarji għandhom iżommu u jaġġornaw fil-livell tal-entità, u fil-livelli subkonsolidati u konsolidati, reġistru ta’ informazzjoni fir-rigward tal-arranġamenti kuntrattwali kollha dwar l-użu ta’ servizzi tal-ICT ipprovduti minn fornituri terzi ta’ servizzi tal-ICT.
L-arranġamenti kuntrattwali msemmija fl-ewwel subparagrafu għandhom jiġu ddokumentati b’mod xieraq, filwaqt li ssir distinzjoni bejn dawk li jkopru s-servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti u dawk li le.
L-entitajiet finanzjarji għandhom jirrappurtaw mill-inqas darba fis-sena lill-awtoritajiet kompetenti dwar l-għadd ta’ arranġamenti ġodda dwar l-użu tas-servizzi tal-ICT, il-kategoriji tal-fornituri terzi ta’ servizzi tal-ICT, it-tip ta’ arranġamenti kuntrattwali u s-servizzi u l-funzjonijiet tal-ICT li qed jiġu pprovduti.
L-entitajiet finanzjarji għandhom jagħmlu disponibbli għall-awtorità kompetenti, fuq talba tagħha, ir-reġistru sħiħ tal-informazzjoni jew, kif mitlub, taqsimiet speċifikati tiegħu, flimkien ma’ kwalunkwe informazzjoni meqjusa bħala neċessarja biex tkun tista’ ssir is-superviżjoni effettiva tal-entità finanzjarja.
L-entitajiet finanzjarji għandhom jinformaw lill-awtorità kompetenti fil-ħin dwar kwalunkwe arranġament kuntrattwali dwar l-użu ta’ servizzi tal-ICT ippjanat li jappoġġja funzjonijiet kritiċi jew importanti kif ukoll meta funzjoni ssir kritika jew importanti.
|
|
EULAW
|
Artikolu 28 4
4. Qabel ma jidħlu f’arranġament kuntrattwali dwar l-użu tas-servizzi tal-ICT, l-entitajiet finanzjarji għandhom:
|
(a)
|
jivvalutaw jekk l-arranġament kuntrattwali jkoprix l-użu ta’ servizzi tal-ICT li jappoġġjaw funzjoni kritika jew importanti;
|
|
(b)
|
jivvalutaw jekk il-kundizzjonijiet superviżorji għall-ikkuntrattar humiex issodisfati;
|
|
(c)
|
jidentifikaw u jivvalutaw ir-riskji rilevanti kollha b’rabta mal-arranġament kuntrattwali, inkluż il-possibbiltà li tali arranġamenti kuntrattwali jistgħu jikkontribwixxu għal żieda fir-riskju ta’ konċentrazzjoni tal-ICT kif imsemmi fl-Artikolu 29;
|
|
(d)
|
iwettqu d-diliġenza dovuta kollha fuq fornituri terzi prospettivi ta’ servizzi tal-ICT u matul il-proċessi kollha tal-għażla u tal-valutazzjoni jiżguraw li l-fornitur terz ta’ servizzi tal-ICT ikun adatt;
|
|
(e)
|
jidentifikaw u jivvalutaw il-kunflitti ta’ interess li jista’ jikkawża l-arranġament kuntrattwali.
|
|
|
EULAW
|
Artikolu 28 5
5. L-entitajiet finanzjarji jistgħu jidħlu biss f’arranġamenti kuntrattwali ma’ fornituri terzi ta’ servizzi tal-ICT li jikkonformaw ma’ standards tas-sigurtà tal-informazzjoni xierqa. Fejn dawk l-arranġamenti kuntrattwali jikkonċernaw funzjonijiet kritiċi jew importanti, l-entitajiet finanzjarji għandhom, qabel ma jikkonkludu l-arranġamenti, iqisu kif xieraq l-użu, mill-fornituri terzi ta’ servizzi tal-ICT, tal-aktar standards għolja u aġġornati ta’ kwalità fis-sigurtà tal-informazzjoni.
|
|
EULAW
|
Artikolu 28 6
6. Fl-eżerċizzju tad-drittijiet tal-aċċess, tal-ispezzjoni u tal-awditjar fuq il-fornitur terz tas-servizzi tal-ICT, l-entitajiet finanzjarji għandhom, abbażi ta’ approċċ ibbażat fuq ir-riskju, jiddeterminaw minn qabel il-frekwenza tal-awditi u tal-ispezzjonijiet kif ukoll l-oqsma li għandhom jiġu awditjati billi jaderixxu ma’ standards tal-awditjar aċċettati b’mod komuni f’konformità ma’ kwalunkwe struzzjoni superviżorja dwar l-użu u l-inkorporazzjoni ta’ tali standards tal-awditjar.
Fejn l-arranġamenti kuntrattwali konklużi ma’ fornituri terzi ta’ servizzi tal-ICT dwar l-użu ta’ servizzi tal-ICT jinvolvu kumplessità teknika għolja, l-entità finanzjarja għandha tivverifika li l-awdituri, kemm jekk interni kif ukoll jekk esterni, jew diversi awdituri, għandhomx il-ħiliet u l-għarfien xieraq biex iwettqu l-awditi u l-valutazzjonijiet rilevanti.
|
|
EULAW
|
Artikolu 28 7
7. L-entitajiet finanzjarji għandhom jiżguraw li l-arranġamenti kuntrattwali dwar l-użu tas-servizzi tal-ICT jistgħu jiġu tterminati fi kwalunkwe waħda miċ-ċirkostanzi li ġejjin:
|
(a)
|
ksur sinifikanti mill-fornitur terz ta’ servizzi tal-ICT tal-liġijiet, tar-regolamenti jew tat-termini kuntrattwali applikabbli;
|
|
(b)
|
iċ-ċirkostanzi identifikati matul il-monitoraġġ tar-riskju relatat mal-ICT minn partijiet terzi meqjusa li jistgħu jbiddlu t-twettiq tal-funzjonijiet ipprovduti permezz tal-arranġament kuntrattwali, inkluż bidliet materjali li jaffettwaw l-arranġament jew is-sitwazzjoni tal-fornitur terz ta’ servizzi tal-ICT;
|
|
(c)
|
dgħufijiet evidenzjati tal-fornitur terz ta’ servizzi tal-ICT marbuta mal-ġestjoni globali tiegħu tar-riskju tal-ICT u b’mod partikolari fil-mod kif jiżgura d-disponibbiltà, l-awtentiċità, l-inegrità u l-kunfidenzjalità tad-data, kemm jekk tkun data personali kif ukoll jekk tkun sensittiva b’mod ieħor, jew data mhux personali;
|
|
(d)
|
fejn l-awtorità kompetenti ma tkunx tista’ twettaq superviżjoni effettiva tal-entità finanzjarja bħala riżultat tal-kundizzjonijiet tal-arranġament kuntrattwali rispettiv jew iċ-ċirkostanzi marbuta miegħu.
|
|
|
EULAW
|
Artikolu 28 8
8. Għas-servizzi tal-ICT li jappoġġjaw funzjonijiet kritiċi jew importanti, l-entitajiet finanzjarji għandhom jistabbilixxu strateġiji ta’ ħruġ. L-istrateġiji ta’ ħruġ għandhom iqisu r-riskji li jistgħu jfiġġu fil-livell ta’ fornituri terzi ta’ servizzi tal-ICT, b’mod partikolari l-falliment possibbli min-naħa tagħhom, deterjorament tal-kwalità tas-servizzi tal-ICT ipprovduti, kwalunkwe tfixkil fl-operat minħabba forniment mhux xieraq jew li ma sarx ta’ servizzi tal-ICT jew kwalunkwe riskju materjali li jirriżulta b’rabta mal-użu xieraq u kontinwu tas-servizz tal-ICT rispettiv, jew it-terminazzjoni tal-arranġamenti kuntrattwali ma’ fornituri terzi ta’ servizzi tal-ICT fi kwalunkwe waħda miċ-ċirkostanzi elenkati fil-paragrafu 7.
L-entitajiet finanzjarji għandhom jiżguraw li jkunu jistgħu joħorġu mill-arranġamenti kuntrattwali mingħajr:
|
(a)
|
tfixkil fl-attivitajiet tal-operat tagħhom,
|
|
(b)
|
limitazzjoni tal-konformità mar-rekwiżiti regolatorji,
|
|
(c)
|
detriment għall-kontinwità u l-kwalità tas-servizzi provduti lill-klijenti.
|
Il-pjanijiet ta’ ħruġ għandhom ikunu komprensivi, dokumentati u, f’konformità mal-kriterji li jinsabu fl-Artikolu 4(2), għandhom jiġu ttestjati biżżejjed u rieżaminati perjodikament.
L-entitajiet finanzjarji għandhom jidentifikaw soluzzjonijiet alternattivi u jiżviluppaw pjanijiet ta’ tranżizzjoni li jippermettulhom ineħħu l-funzjonijiet u s-servizzi tal-ICT ikkuntrattati u d-data rilevanti mingħand il-fornitur terz ta’ servizzi tal-ICT u li jittrasferuhom b’mod sigur u integrali lil fornituri alternattivi jew jinkorporawhom mill-ġdid internament.
L-entitajiet finanzjarji għandu jkollhom stabbiliti miżuri ta’ kontinġenza xierqa biex iżommu l-kontinwità tal-operat fil-każ li jseħħu ċ-ċirkostanzi msemmija fl-ewwel subparagrafu.
|
|
EULAW
|
Artikolu 21 Miżuri ta' ġestjoni tar-riskji taċ-ċibersigurtà
-
|
|
EULAW
|
Artikolu 9 Sistema ta' ġestjoni tar-riskju
-
|
|
EULAW
|
Artikolu 3 Ġestjoni tar-riskju tal-ICT
Artikolu 3
Ġestjoni tar-riskju tal-ICT
L-entitajiet finanzjarji għandhom jiżviluppaw, jiddokumentaw u jimplimentaw politiki u proċeduri tal-ġestjoni tar-riskju tal-ICT li għandu jkun fihom dawn kollha li ġejjin:
(a)
indikazzjoni tal-approvazzjoni tal-livell ta’ tolleranza tar-riskju għar-riskju tal-ICT stabbilit f’konformità mal-Artikolu 6(8), il-punt (b) tar-Regolament (UE) 2022/2554;
(b)
proċedura u metodoloġija għat-twettiq tal-valutazzjoni tar-riskju tal-ICT, li tidentifika:
(i)
il-vulnerabbiltajiet u t-theddid li jaffettwaw jew li jistgħu jaffettwaw il-funzjonijiet tan-negozju appoġġati, is-sistemi tal-ICT u l-assi tal-ICT li jappoġġaw dawk il-funzjonijiet;
(ii)
l-indikaturi kwantitattivi jew kwalitattivi biex jitkejlu l-impatt u l-probabbiltà tal-vulnerabbiltajiet u t-theddid imsemmija fil-punt (i);
(c)
il-proċedura biex jiġu identifikati, implimentati u ddokumentati miżuri għat-trattament tar-riskju tal-ICT għar-riskji tal-ICT identifikati u vvalutati, inkluża d-determinazzjoni tal-miżuri għat-trattament tar-riskju tal-ICT meħtieġa biex ir-riskju tal-ICT jinġieb fil-livell tat-tolleranza tar-riskju msemmi fil-punt (a);
(d)
għar-riskji residwali tal-ICT li jkunu għadhom preżenti wara l-implimentazzjoni tal-miżuri tat-trattament tar-riskju tal-ICT imsemmija fil-punt (c):
(i)
dispożizzjonijiet dwar l-identifikazzjoni ta’ dawk ir-riskji residwali tal-ICT;
(ii)
l-assenjazzjoni tar-rwoli u tar-responsabbiltajiet fir-rigward ta’:
(1)
l-aċċettazzjoni tar-riskji residwali tal-ICT li jaqbżu l-livell ta’ tolleranza tar-riskju tal-entità finanzjarja msemmi fil-punt (a);
(2)
għall-proċess ta’ rieżami msemmi fil-punt (iv) ta’ dan il-punt (d);
(iii)
l-iżvilupp ta’ inventarju tar-riskji residwali tal-ICT aċċettati, inkluża ġustifikazzjoni għall-aċċettazzjoni tagħhom;
(iv)
dispożizzjonijiet dwar ir-rieżami tar-riskji residwali tal-ICT aċċettati mill-anqas darba fis-sena, inklużi:
(1)
l-identifikazzjoni ta’ kwalunkwe tibdil fir-riskji residwali tal-ICT;
(2)
il-valutazzjoni tal-miżuri ta’ mitigazzjoni disponibbli;
(3)
il-valutazzjoni ta’ jekk ir-raġunijiet li jiġġustifikaw l-aċċettazzjoni tar-riskji residwali tal-ICT jkunux għadhom validi u applikabbli fid-data tar-rieżami;
(e)
dispożizzjonijiet dwar il-monitoraġġ ta’:
(i)
kwalunkwe tibdil fix-xenarju tar-riskju tal-ICT u tat-theddid ċibernetiku;
(ii)
vulnerabbiltajiet u theddid interni u esterni:
(iii)
ir-riskju tal-ICT tal-entità finanzjarja li jippermetti l-individwazzjoni fil-pront ta’ tibdiliet li jistgħu jaffettwaw il-profil tar-riskju tal-ICT tagħha;
(f)
dispożizzjonijiet dwar proċess biex jiġi żgurat li jitqies kwalunkwe tibdil fl-istrateġija tan-negozju u fl-istrateġija tar-reżiljenza operazzjonali diġitali tal-entità finanzjarja.
Għall-finijiet tal-ewwel paragrafu, il-punt (c), il-proċedura msemmija f’dak il-punt għandha tiżgura:
(a)
il-monitoraġġ tal-effettività tal-miżuri għat-trattament tar-riskju tal-ICT implimentati;
(b)
il-valutazzjoni ta’ jekk intlaħqux il-livelli ta’ tolleranza tar-riskju stabbiliti tal-entità finanzjarja;
(c)
il-valutazzjoni ta’ jekk l-entità finanzjarja tkunx ħadet azzjonijiet biex tikkoreġi jew ittejjeb dawk il-miżuri meta meħtieġ.
|
|
EULAW
|
Artikolu 31 Ġestjoni tar-riskju tal-ICT
-
|
|
EULAW
|
Artikolu 8 Identifikazzjoni
-
|
|
EULAW
|
Artikolu 8 Identifikazzjoni
-
|
|
EULAW
|
Artikolu 8 2
2. L-entitajiet finanzjarji għandhom jidentifikaw, fuq bażi kontinwa, is-sorsi kollha tar-riskju tal-ICT, b’mod partikolari l-esponiment għar-riskju għal u minn entitajiet finanzjarji oħra, u jivvalutaw it-theddid ċibernetiku u l-vulnerabbiltajiet tal-ICT rilevanti għall-funzjonijiet tan-negozju tagħhom appoġġjati mill-ICT, u għall-assi tal-informazzjoni u l-assi tal-ICT. L-entitajiet finanzjarji għandhom jirrieżaminaw fuq bażi regolari, u mill-inqas darba fis-sena, ix-xenarji tar-riskju li jħallu impatt fuqhom.
|
Kwistjonijiet marbuta
- Secure Controls Framework -
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/
Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.
|