+Artikel 14 Rapportageverplichtingen van fabrikanten
---+Artikel 14 1.
---+Artikel 14 2.
---+Artikel 14 3.
---+Artikel 14 4.
---+Artikel 14 5.
---+Artikel 14 6.
---+Artikel 14 7.
---+Artikel 14 8.
---+Artikel 14 9.
---+Artikel 14 10.

Artikel 14 Rapportageverplichtingen van fabrikanten

-

1. Overzicht

,
Artikel 14 1.
Een fabrikant doet tegelijkertijd aan het overeenkomstig lid 7 van dit artikel als coördinator aangewezen CSIRT en aan Enisa melding van elke actief uitgebuite kwetsbaarheid in het product met digitale elementen waarvan hij kennis krijgt. De fabrikant doet van die actief uitgebuite kwetsbaarheid melding via het op grond van artikel 16 opgerichte centrale meldingsplatform.
Artikel 14 2.

Ten behoeve van de in lid 1 bedoelde melding dient de fabrikant het volgende in:

a) 

een vroegtijdige waarschuwing over een actief uitgebuite kwetsbaarheid, zonder onnodige vertraging en in elk geval binnen 24 uur nadat de fabrikant er kennis van heeft gekregen, met vermelding, in voorkomend geval, van de lidstaten op het grondgebied waarvan de fabrikant ervan op de hoogte is dat zijn product met digitale elementen beschikbaar is gesteld;

b) 

tenzij de relevante informatie reeds is verstrekt, een kwetsbaarheidsmelding, zonder onnodige vertraging en in elk geval binnen 72 uur nadat de fabrikant kennis heeft gekregen van de actief uitgebuite kwetsbaarheid, waarin algemene informatie wordt verstrekt, voor zover beschikbaar, over het desbetreffende product met digitale elementen, de algemene aard van de uitbuiting en van de betroffen kwetsbaarheid, alsook alle genomen corrigerende of risicobeperkende maatregelen, en corrigerende of risicobeperkende maatregelen die gebruikers kunnen nemen, en waarin in voorkomend geval ook wordt aangegeven hoe gevoelig de fabrikant de gemelde informatie acht;

c) 

tenzij de relevante informatie reeds is verstrekt, een eindverslag, uiterlijk 14 dagen nadat een corrigerende of risicobeperkende maatregel beschikbaar is, waarin ten minste het volgende is opgenomen:

i) 

een beschrijving van de kwetsbaarheid, inclusief de ernst en de gevolgen ervan;

ii) 

indien beschikbaar, informatie over elke kwaadwillige actor die de kwetsbaarheid heeft uitgebuit of die de kwetsbaarheid aan het uitbuiten is;

iii) 

details over de beveiligingsupdate of andere corrigerende maatregelen die beschikbaar zijn gesteld om de kwetsbaarheid te verhelpen.
Artikel 14 3.
Een fabrikant doet tegelijkertijd aan het overeenkomstig lid 7 van dit artikel als coördinator aangewezen CSIRT en aan Enisa melding van elk ernstig incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen waarvan hij kennis krijgt. De fabrikant doet van dat incident melding via het op grond van artikel 16 opgerichte centrale meldingsplatform.
Artikel 14 4.

Ten behoeve van de in lid 3 bedoelde melding dient de fabrikant het volgende in:

a) 

een vroegtijdige waarschuwing over een ernstig incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen, zonder onnodige vertraging en in elk geval binnen 24 uur nadat de fabrikant er kennis van heeft gekregen, waarin ten minste wordt vermeld of het incident vermoedelijk door onwettige of kwaadwillige handelingen is veroorzaakt, en waarin, in voorkomend geval, ook de lidstaten worden vermeld op het grondgebied waarvan de fabrikant ervan op de hoogte is dat zijn product met digitale elementen beschikbaar is gesteld;

b) 

tenzij de relevante informatie reeds is verstrekt, een incidentmelding, zonder onnodige vertraging en in elk geval binnen 72 uur nadat de fabrikant kennis heeft gekregen van het incident, waarin algemene informatie wordt verstrekt, voor zover beschikbaar, over de aard van het incident, een eerste beoordeling van het incident, alsook alle genomen corrigerende of risicobeperkende maatregelen, en corrigerende of risicobeperkende maatregelen die gebruikers kunnen nemen, en waarin in voorkomend geval ook wordt aangegeven hoe gevoelig de fabrikant de gemelde informatie acht;

c) 

tenzij de relevante informatie reeds is verstrekt, binnen één maand na de indiening van de incidentmelding uit hoofde van punt b), een eindverslag waarin ten minste het volgende is opgenomen:

i) 

een gedetailleerde beschrijving van het incident, inclusief de ernst en de gevolgen ervan;

ii) 

het soort bedreiging of de grondoorzaak die waarschijnlijk tot het incident heeft geleid;

iii) 

toegepaste en lopende beperkende maatregelen.
Artikel 14 5.

Voor de toepassing van lid 3 wordt een incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen als ernstig beschouwd wanneer:

a) 

het negatieve gevolgen heeft of negatieve gevolgen kan hebben voor het vermogen van een product met digitale elementen om de beschikbaarheid, authenticiteit, integriteit of vertrouwelijkheid van gevoelige of belangrijke gegevens of functies te beschermen, of

b) 

het heeft geleid of kan leiden tot de invoering of uitvoering van kwaadwillige code in een product met digitale elementen of in de netwerk- en informatiesystemen van een gebruiker van het product met digitale elementen.
Artikel 14 6.
Indien nodig kan het als coördinator aangewezen CSIRT dat als eerste de melding ontvangt, fabrikanten verzoeken een tussentijds verslag te verstrekken over relevante updates van de status van de actief uitgebuite kwetsbaarheid of het ernstige incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen.
Artikel 14 7.
De in de leden 1 en 3 van dit artikel bedoelde meldingen worden ingediend via het in artikel 16 bedoelde centrale meldingsplatform met gebruikmaking van een van de in artikel 16, lid 1, bedoelde elektronische endpoints voor melding. De melding wordt ingediend met gebruikmaking van het elektronische endpoint voor melding van het als coördinator aangewezen CSIRT van de lidstaat waar de fabrikanten hun hoofdvestiging in de Unie hebben, en is tegelijkertijd toegankelijk voor Enisa.

Voor de toepassing van deze verordening wordt een fabrikant geacht zijn hoofdvestiging in de Unie te hebben in de lidstaat waar de besluiten met betrekking tot de cyberbeveiliging van zijn product met digitale elementen hoofdzakelijk worden genomen. Indien niet kan worden bepaald welke lidstaat dat is, wordt de hoofdvestiging geacht zich te bevinden in de lidstaat waar de betrokken fabrikant de vestiging met het grootste aantal werknemers in de Unie heeft.

Indien een fabrikant geen hoofdvestiging in de Unie heeft, dient hij de in de leden 1 en 3 bedoelde meldingen in met gebruikmaking van het elektronische endpoint voor melding van het als coördinator aangewezen CSIRT in de lidstaat die bepaald is op grond van onderstaande volgorde en op basis van de informatie waarover de fabrikant beschikt:

a) 

de lidstaat waar de gemachtigde vertegenwoordiger die namens de fabrikant optreedt voor het grootste aantal producten met digitale elementen van die fabrikant, is gevestigd;

b) 

de lidstaat waar de importeur is gevestigd die het grootste aantal producten met digitale elementen van die fabrikant in de handel brengt;

c) 

de lidstaat waar de distributeur is gevestigd die het grootste aantal producten met digitale elementen van die fabrikant op de markt aanbiedt;

d) 

de lidstaat waar het grootste aantal gebruikers van producten met digitale elementen van die fabrikant is gevestigd.

Met betrekking tot de derde alinea, punt d), kan een fabrikant bij hetzelfde als coördinator aangewezen CSIRT waaraan hij de eerste melding heeft gedaan, meldingen indienen in verband met elke volgende actief uitgebuite kwetsbaarheid of ernstig incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen.
Artikel 14 8.
Nadat de fabrikant kennis heeft gekregen van een actief uitgebuite kwetsbaarheid of een ernstig incident dat gevolgen heeft voor de beveiliging van het product met digitale elementen, stelt hij de getroffen gebruikers van het product met digitale elementen en indien passend alle gebruikers, op de hoogte van die kwetsbaarheid of van dat incident en, indien nodig, van risicobeperking en corrigerende maatregelen die de gebruikers kunnen nemen om de gevolgen van die kwetsbaarheid of dat incident te beperken, indien passend in een gestructureerd, machineleesbaar formaat dat gemakkelijk automatisch verwerkbaar is. Indien de fabrikant de gebruikers van het product met digitale elementen niet tijdig op de hoogte brengt, kunnen de als coördinatoren aangewezen CSIRT’s dergelijke informatie verstrekken aan de gebruikers wanneer dat evenredig en noodzakelijk wordt geacht om de gevolgen van die kwetsbaarheid of dat incident te voorkomen of te beperken.
Artikel 14 9.
Uiterlijk op 11 december 2025 stelt de Commissie overeenkomstig artikel 61 van deze verordening gedelegeerde handelingen vast teneinde deze verordening aan te vullen door de voorwaarden te specificeren voor de toepassing van de cyberbeveiligingsgerelateerde redenen voor het uitstellen van de verspreiding van meldingen als bedoeld in artikel 16, lid 2 van deze verordening. De Commissie werkt samen met het op grond van artikel 15 van Richtlijn (EU) 2022/2555 opgerichte CSIRT-netwerk en Enisa bij het opstellen van de ontwerpen van gedelegeerde handelingen.
Artikel 14 10.
De Commissie kan door middel van uitvoeringshandelingen het formaat en de procedures van de in dit artikel en in de artikelen 15 en 16 bedoelde meldingen nader specificeren. Die uitvoeringshandelingen worden volgens de in artikel 62, lid 2, bedoelde onderzoeksprocedure vastgesteld. De Commissie werkt samen met het CSIRT-netwerk en Enisa bij het opstellen van die ontwerpuitvoeringshandelingen.

1.1 Referenties

1.2 Geïdentificeerde eisen

1.3 Gerelateerde standaarden

2. Geïdentificeerde eisen

Eisen

3. Gerelateerde standaarden

Standaarden
SCF Incident Classification & Prioritization

Description

Mechanisms exist to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Incident Stakeholder Reporting

Description

Mechanisms exist to timely-report incidents to applicable:
(1) Internal stakeholders;
(2) Affected clients & third-parties; and
(3) Regulatory authorities.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Basic incident response plan
∙ Designate incident response contact

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Documented incident response plan
∙ Incident log
∙ Designated IR team

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal incident response program
∙ IR playbooks
∙ Tabletop exercises

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise incident response program
∙ 24/7 SOC monitoring
∙ SOAR platform

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)
∙ IR retainer
∙ Threat hunting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to timely-report incidents to applicable:
(1) Internal stakeholders;
(2) Affected clients & third-parties; and
(3) Regulatory authorities.

Level 4 Quantitatively Controlled

Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Cyber Incident Reporting for Sensitive / Regulated Data

Description

Mechanisms exist to report sensitive and/or regulated data incidents in a timely manner.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Incident Response Plan (IRP)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to report sensitive/regulated data incidents in a timely manner.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Incident Classification & Prioritization

Description

Mechanisms exist to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ National Cyber Incident Scoring
System (NCISS) (https://cisa.gov)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to identify classes of incidents and actions to take to ensure the continuation of organizational missions and business functions.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Incident Stakeholder Reporting

Description

Mechanisms exist to timely-report incidents to applicable:
(1) Internal stakeholders;
(2) Affected clients & third-parties; and
(3) Regulatory authorities.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Basic incident response plan
∙ Designate incident response contact

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Documented incident response plan
∙ Incident log
∙ Designated IR team

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal incident response program
∙ IR playbooks
∙ Tabletop exercises

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise incident response program
∙ 24/7 SOC monitoring
∙ SOAR platform

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise SOC with SIEM/SOAR (e.g., Splunk SOAR, Palo Alto XSOAR)
∙ IR retainer
∙ Threat hunting

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ IT and/or cybersecurity personnel facilitate prompt response to suspected or confirmed security incidents, including timely notification to affected stakeholders.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to timely-report incidents to applicable:
(1) Internal stakeholders;
(2) Affected clients & third-parties; and
(3) Regulatory authorities.

Level 4 Quantitatively Controlled

Incident Response (IRO) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Cyber Incident Reporting for Sensitive / Regulated Data

Description

Mechanisms exist to report sensitive and/or regulated data incidents in a timely manner.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Incident Response Plan (IRP)

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Incident Response Plan (IRP)

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Integrated Incident Response Program (IIRP)
∙ Integrated Security Incident Response Team (ISIRT)

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Incident Response (IRO) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with IRO domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Incident response-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ IT and/or cybersecurity personnel use an informal process to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 2 Planned Tracked

Incident Response (IRO) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with DCH domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Incident response-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Incident response management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ IT and/or cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.

Level 3 Well Defined

Incident Response (IRO) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with IRO domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Cybersecurity personnel operate an incident response capability using a documented and tested Incident Response Plan (IRP) to facilitate incident management operations that cover preparation, detection and analysis, containment, eradication and recovery.
▪ An incident response team, or similar function, is appropriately staffed and supported to implement and maintain IRO domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of incident response operations (e.g., incident management software).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IRO domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to report sensitive/regulated data incidents in a timely manner.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
SCF Disclosure of Vulnerabilities

Description

Mechanisms exist to disclose information about vulnerabilities to relevant stakeholders, including:
(1) A description of the vulnerability(ies);
(2) Affected product(s) and/or service(s);
(3) Potential impact of the vulnerability(ies);
(4) Severity of the vulnerability(ies); and
(5) Guidance to remediate the vulnerability(ies).

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Notify customers of vulnerabilities in any developed products via email/website

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Security advisory template and distribution process
∙ security.txt / contact for vulnerability reports

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Vulnerability disclosure process with advisories (description, impact, remediation)
∙ Coordinated disclosure timelines

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Product Security Incident Response Team (PSIRT) disclosure process (ISO/IEC 29147)
∙ CVE issuance for product vulnerabilities
∙ Customer notification channels

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise coordinated vulnerability disclosure program (ISO/IEC 29147, CNA participation)
∙ Public advisory portal and machine-readable advisories (CSAF)
∙ Regulatory notification (e.g., EU CRA) integration

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

SCR-CMM Level 1 criteria definitions are not available for this control:
▪ A reasonable person would conclude this control requires a structured process.
▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality.

Level 2 Planned Tracked

Technology Development & Acquisition (TDA) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Technology development and acquisition-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Technology development and acquisition management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Secure development practices mostly conform to industry-recognized standards for secure engineering of Technology Assets, Applications and/or Services (TAAS) (e.g., OWASP, NIST SP 800-218 and NIST SP 800-160).
▪ An application development team, or similar function, uses a structured process to design, build and maintain secure configurations for test, development, staging and production environments.

Level 3 Well Defined

Technology Development & Acquisition (TDA) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with TDA domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with TDA domain capabilities are well-documented and kept current by process owners.
▪ A software development team, or similar function, is appropriately staffed and supported to implement and maintain TDA domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of technology development and acquisition management (e.g., project management software, software escrow solution and software testing tools).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with TDA domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to disclose information about vulnerabilities to relevant stakeholders, including:
(1) A description of the vulnerability(ies);
(2) Affected product(s) and/or service(s);
(3) Potential impact of the vulnerability(ies);
(4) Severity of the vulnerability(ies); and
(5) Guidance to remediate the vulnerability(ies).

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.