+Secure Baseline Configurations
---+Account Lockout
---+Concurrent Session Control
---+Session Lock
---+Pattern-Hiding Displays
---+Session Termination
---+User-Initiated Logouts / Message Displays
---+Non-Console Administrative Access
---+Wireless Access Authentication & Encryption
---+Bluetooth & Wireless Devices
---+Infrared Communications
---+Microphones & Web Cameras
---+Multi-Function Devices (MFD)
---+Radio Frequency Identification (RFID) Security
---+Contactless Access Control Systems
---+Thin Nodes
---+Video Teleconference (VTC) Security
---+Voice Over Internet Protocol (VoIP) Security
---+Disable Wireless Networking

Secure Baseline Configurations

Description

Mechanisms exist to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted hardening standards.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Secure Baseline Configurations (SBC)
∙ Defense Information Security Agency (DISA) Secure Technology Implementation Guides (STIGs)
∙ Center for Internet Security (CIS) Benchmarks
∙ Original Equipment Manufacturer (OEM) security guides

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Configuration Management (CFG) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with CFG domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Configuration management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Configurations mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).

Level 2 Planned Tracked

Configuration Management (CFG) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Configuration management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Configuration management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ Secure Baseline Configurations (SBC) are used to configure Technology Assets, Applications and/or Services (TAAS) according to the principles of least functionality and least privilege, mostly conforming to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).
▪ The restrictiveness of the SBCs are commensurate with the criticality of the TAAS and/or sensitivity of the data being protected, in accordance with applicable laws, regulations and frameworks.
▪ Tailored SBC are created for higher-risk operating environments and/or for TAAS that store, process or transmit sensitive/regulated data.

Level 3 Well Defined

Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners.
▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to develop, document and maintain secure baseline configurations for Technology Assets, Applications and/or Services (TAAS) that are consistent with industry-accepted system hardening standards.

Level 4 Quantitatively Controlled

Configuration Management (CFG) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational.
▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities.

Level 5 Continuously Improving

1. Przegląd

Tytuł	Norma
Account Lockout	Description Mechanisms exist to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Microsoft Active Directory (https://microsoft.com) ∙ Microsoft Entra (https://microsoft.com) ∙ AWS IAM (https://aws.amazon.com) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Microsoft Active Directory (https://microsoft.com) ∙ Microsoft Entra (https://microsoft.com) ∙ AWS IAM (https://aws.amazon.com) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Microsoft Active Directory (https://microsoft.com) ∙ Microsoft Entra (https://microsoft.com) ∙ AWS IAM (https://aws.amazon.com) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Microsoft Active Directory (https://microsoft.com) ∙ Microsoft Entra (https://microsoft.com) ∙ AWS IAM (https://aws.amazon.com) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Microsoft Active Directory (https://microsoft.com) ∙ Microsoft Entra (https://microsoft.com) ∙ AWS IAM (https://aws.amazon.com) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions. ▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to enforce a limit for consecutive invalid login attempts by a user during an organization-defined time period and automatically locks the account when the maximum number of unsuccessful attempts is exceeded. Level 4 Quantitatively Controlled Identification & Authentication (IAC) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Concurrent Session Control	Description Mechanisms exist to limit the number of concurrent sessions for each system account. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions. ▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to limit the number of concurrent sessions for each system account. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Session Lock	Description Mechanisms exist to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions. ▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to initiate a session lock after an organization-defined time period of inactivity, or upon receiving a request from a user and retain the session lock until the user reestablishes access using established identification and authentication methods. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Pattern-Hiding Displays	Description Mechanisms exist to implement pattern-hiding displays to conceal information previously visible on the display during the session lock. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions. ▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to implement pattern-hiding displays to conceal information previously visible on the display during the session lock. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Session Termination	Description Automated mechanisms exist to log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Identification & Authentication (IAC) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with IAC domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Identity & Access Management (IAM)-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IAM controls are primarily administrative in nature (e.g., policies & standards) to manage accounts and permissions. ▪ IT and/or cybersecurity personnel identify and implement IAM cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to automatically log out users, both locally on the network and for remote sessions, at the end of the session or after an organization-defined period of inactivity. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
User-Initiated Logouts / Message Displays	Description Mechanisms exist to provide a logout capability and display an explicit logout message to users indicating the reliable termination of the session. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Identification & Authentication (IAC) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with IAC domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with IAC domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with IAC domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Identity & Access Management (IAM)-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines) to enforce Logical Access Control (LAC). ▪ IAM may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel to implement Role Based Access Control (RBAC) practices for the management of user, group and system accounts, including privileged accounts. ▪ A directory services technology is used to centrally manage identities and permissions with RBAC. Due to technical or business limitations, asset/process owners are empowered to operate a decentralized access control program for their specific Technology Assets, Applications and/or Services (TAAS) that cannot be integrated into directory services. ▪ Configuration management and IAM functions collaborate to ensure Secure Baseline Configurations (SBC) enforce “least privileges” on TAAS. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to provide a logout capability and display an explicit logout message to users indicating the reliable termination of the session. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Non-Console Administrative Access	Description Cryptographic mechanisms exist to protect the confidentiality and integrity of non-console administrative access. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Use SSH/HTTPS (not Telnet/HTTP) for device administration Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ SSH/HTTPS/RDP with TLS for all administrative access; insecure protocols disabled Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Encrypted administrative protocols enforced (SSH, TLS 1.2+, RDP with NLA) ∙ Jump host for administration Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ PAM session brokering with encrypted channels ∙ Certificate-based administrative access Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Enterprise privileged access standards (PAM, encrypted protocols, mutual TLS, certificate-based auth) ∙ Automated detection of cleartext administrative protocols SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data. Level 2 Planned Tracked Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational cryptographic capability exists to protect the confidentiality and integrity of non-console administrative access. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Wireless Access Authentication & Encryption	Description Mechanisms exist to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov) ∙ Wi-Fi Protected Access 3 (WPA3) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov) ∙ Wi-Fi Protected Access 3 (WPA3) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov) ∙ Wi-Fi Protected Access 3 (WPA3) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov) ∙ Wi-Fi Protected Access 3 (WPA3) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ NIST Cryptographic Module Validation Program (CMVP) (https://csrc.nist.gov) ∙ Wi-Fi Protected Access 3 (WPA3) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Cryptographic Protections (CRY) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with CRY domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Cryptography management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ IT and/or cybersecurity personnel provide an encryption solution (software or hardware) for the storage of sensitive/regulated data. Level 2 Planned Tracked Cryptographic Protections (CRY) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CRY domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with CRY domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CRY domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Cryptographic management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Cryptographic management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ Technology Assets, Applications and/or Services (TAAS) that store, process or transmit sensitive/regulated data use cryptographic mechanisms to prevent unauthorized disclosure of information as an alternate to physical safeguards. ▪ External compliance requirements for cryptography are identified and documented, based on applicable laws, regulations and contractual obligations. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to implement cryptographic mechanisms that are applicability for statutory, regulatory and/or contractual compliance obligations. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to protect the confidentiality and integrity of wireless networking technologies by implementing authentication and strong encryption. Level 4 Quantitatively Controlled Cryptographic Protections (CRY) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Bluetooth & Wireless Devices	Description Mechanisms exist to prevent the usage of Bluetooth and wireless devices (e.g., Near Field Communications (NFC)) in sensitive areas or unless used in a Radio Frequency (RF)-screened building. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to prevent the usage of Bluetooth and wireless devices (e.g., Near Field Communications (NFC)) in sensitive areas or unless used in a Radio Frequency (RF)-screened building. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Infrared Communications	Description Mechanisms exist to prevent line of sight and reflected infrared (IR) communications use in an unsecured space. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Asset Management (AST) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with AST domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Asset management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. ▪ Asset management is informally assigned as an additional duty to existing IT/cybersecurity personnel. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to prevent line of sight and reflected infrared (IR) communications use in an unsecured space. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Microphones & Web Cameras	Description Mechanisms exist to configure assets to prohibit the use of endpoint-based microphones and web cameras in secure areas or where sensitive and/or regulated information is discussed. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Rules of Behavior (RoB) / Acceptable Use ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to configure assets to prohibit the use of endpoint-based microphones and web cameras in secure areas or where sensitive/regulated information is discussed. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Multi-Function Devices (MFD)	Description Mechanisms exist to securely configure Multi-Function Devices (MFD) according to industry-recognized secure practices for the type of device. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to securely configure Multi-Function Devices (MFD) according to industry-recognized secure practices for the type of device. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Radio Frequency Identification (RFID) Security	Description Mechanisms exist to securely govern Radio Frequency Identification (RFID) deployments to ensure RFID is used safely and securely to protect the confidentiality and integrity of data and prevent the compromise of secure spaces. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). ▪ Enhanced security requirements for Bluetooth and wireless devices in sensitive/regulated areas are primarily administrative and preventative in nature. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to securely govern Radio Frequency Identification (RFID) deployments to ensure RFID is used safely and securely to protect the confidentiality and integrity of data and prevent the compromise of secure spaces. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Contactless Access Control Systems	Description Mechanisms exist to securely configure contactless access control systems incorporating contactless RFID or smart cards to protect the confidentiality and integrity of data and prevent the compromise of secure spaces. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ IT Asset Management (ITAM) program ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to securely configure contactless access control systems incorporating contactless RFID or smart cards to protect the confidentiality and integrity of data and prevent the compromise of secure spaces. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Thin Nodes	Description Mechanisms exist to configure thin nodes to have minimal functionality and information storage. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) ∙ Configuration Management (CM) program Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ Configuration Management (CM) program Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Configuration Management (CM) program Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ Configuration Management (CM) program Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) ∙ Configuration Management (CM) program SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Endpoint Security (END) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with END domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Endpoint security management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. Level 2 Planned Tracked Endpoint Security (END) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with END domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with END domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with END domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Endpoint security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Endpoint security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to configure thin nodes to have minimal functionality and information storage. Level 4 Quantitatively Controlled Endpoint Security (END) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Video Teleconference (VTC) Security	Description Mechanisms exist to implement secure Video Teleconference (VTC) capabilities on endpoint devices and in designated conference rooms, to prevent potential eavesdropping. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to implement secure Video Teleconference (VTC) capabilities on endpoint devices and in designated conference rooms, to prevent potential eavesdropping. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Voice Over Internet Protocol (VoIP) Security	Description Mechanisms exist to implement secure Internet Protocol Telephony (IPT) that logically or physically separates Voice Over Internet Protocol (VoIP) traffic from data networks. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) ∙ Network segmentation (logical and/or physical) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally SCR-CMM Level 1 criteria definitions are not available for this control: ▪ A reasonable person would conclude this control requires a structured process. ▪ At this level of maturity, the "ad hoc" nature of performing a capability informally would indicate the intent of the control is not met due to a lack of consistency and formality. Level 2 Planned Tracked Asset Management (AST) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with AST domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with AST domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with AST domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Asset management-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Asset management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ The IT department establishes, maintains and updates an inventory that contains a listing of all organizational-owned TAASD, at a minimum covering common devices (e.g., laptops, workstations and servers). Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to implement secure Internet Protocol Telephony (IPT) that logically or physically separates Voice Over Internet Protocol (VoIP) traffic from data networks. Level 4 Quantitatively Controlled Utilize SCR-CMM Level 3 criteria definitions: ▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control. ▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.
Disable Wireless Networking	Description Mechanisms exist to disable unnecessary wireless networking capabilities that are internally embedded within system components prior to issuance to end users. Possible Solutions & Considerations Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2 ∙ Secure Baseline Configurations (SBC) Small Business (10-49 staff) / BLS Firm Size Classes 3-4 ∙ Secure Baseline Configurations (SBC) Medium Business (50-249 staff) / BLS Firm Size Classes 5-6 ∙ Secure Baseline Configurations (SBC) Large Business (250-999 staff) / BLS Firm Size Classes 7-8 ∙ Secure Baseline Configurations (SBC) Enterprise (> 1,000 staff) / BLS Firm Size Class 9 ∙ Secure Baseline Configurations (SBC) SCR-CMM Level 0 Not Performed Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed. Level 1 Performed Informally Network Security (NET) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include: ▪ Policies, standards & procedures associated with NET domain capabilities provide limited coverage due to the depth and breadth of the existing documentation. ▪ Network security-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices. Level 2 Planned Tracked Network Security (NET) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with NET domain capabilities are formally documented and centrally-managed by the entity. ▪ Standardized Operating Procedures (SOP) associated with NET domain capabilities are documented and maintained by process owners. ▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with NET domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD). ▪ Network security-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines). ▪ Network security management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel. ▪ IT personnel define secure networking practices to protect the Confidentiality, Integrity, Availability and Safety (CIAS) of the organization's TAASD. ▪ Secure Baseline Configurations (SBC) enforce the principles of least privileges and least functionality for boundary protection technologies. Level 3 Well Defined Configuration Management (CFG) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Policies and standards associated with CFG domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function. ▪ Standardized Operating Procedures (SOP) associated with CFG domain capabilities are well-documented and kept current by process owners. ▪ A configuration management team, or similar function, is appropriately staffed and supported to implement and maintain CFG domain capabilities. ▪ Technology is leveraged to enhance the efficiency and accuracy of configuration management operations (e.g., Configuration Management Database (CMBD) Asset Management solution). ▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CFG domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls). ▪ An implemented and operational capability exists to disable unnecessary wireless networking capabilities that are internally embedded within system components prior to issuance to end users. Level 4 Quantitatively Controlled Network Security (NET) capabilities, in addition to being standardized across the entity and centrally managed to ensure consistency across Technology Assets, Applications, Services and/or Data (TAASD), efforts are metrics driven to provide sufficient insight for decision makers to predict optimal performance, ensure continued operations and/or identify areas for improvement. Capability criteria associated with this control reasonably expect the following criteria to exist: ▪ Applicable SCR-CMM Level 3 (Well Defined) capabilities are implemented and operational. ▪ Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs). ▪ Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs). ▪ Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties. ▪ Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review). ▪ Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes. ▪ Business and technical stakeholders are involved in reviewing and approving proposed changes to evolve capabilities. Level 5 Continuously Improving Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions: ▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control. ▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies. ▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania
Źródło	Wymaganie

3. Powiązane regulacje

Regulacje

EULAW

Artykuł 17 System zarządzania jakością
-

EULAW

Artykuł 8 Polityki i procedury dotyczące operacji ICT
-

EULAW

Artykuł 11 Bezpieczeństwo danych i systemów
-

EULAW

Artykuł 11 Bezpieczeństwo danych i systemów
-

EULAW

Artykuł 13 Zarządzanie bezpieczeństwem sieci

Artykuł 13

Zarządzanie bezpieczeństwem sieci

Przy wprowadzaniu zabezpieczeń zapewniających ochronę sieci przed włamaniami i wykorzystaniem danych niezgodnie z przeznaczeniem podmioty finansowe opracowują, dokumentują i wdrażają polityki, procedury, protokoły i narzędzia w zakresie zarządzania bezpieczeństwem sieci obejmujące wszystkie następujące elementy:

segregację i segmentację systemów i sieci ICT z uwzględnieniem:

(i)

krytyczności lub istotności funkcji, którą te systemy i sieci ICT wspierają;

(ii)

klasyfikacji ustanowionej zgodnie z art. 8 ust. 1 rozporządzenia (UE) 2022/2554;

(iii)

ogólnego profilu ryzyka związanego z zasobami ICT wykorzystującymi te systemy i sieci ICT;

dokumentację wszystkich połączeń sieciowych i przepływów danych podmiotu finansowego;

wykorzystanie odrębnej i wyspecjalizowanej sieci do administrowania zasobami ICT;

określenie i wdrożenie kontroli dostępu do sieci w celu zapobiegania podłączaniu do sieci podmiotu finansowego za pomocą jakiegokolwiek nieuprawnionego urządzenia lub systemu lub jakiegokolwiek punktu końcowego niespełniającego wymogów bezpieczeństwa podmiotu finansowego oraz wykrywania takich przypadków;

szyfrowanie połączeń sieciowych przechodzących przez sieci korporacyjne, sieci publiczne, sieci krajowe, sieci podmiotów zewnętrznych i sieci bezprzewodowe do celów wykorzystywanych protokołów komunikacyjnych, z uwzględnieniem wyników zatwierdzonej klasyfikacji danych, wyników oceny ryzyka związanego z ICT oraz szyfrowania połączeń sieciowych, o których mowa w art. 6 ust. 2;

projektowanie sieci zgodnie z wymogami bezpieczeństwa ICT ustanowionymi przez podmiot finansowy, z uwzględnieniem wiodących praktyk w celu zapewnienia poufności, integralności i dostępności sieci;

zabezpieczenie ruchu w sieci między sieciami wewnętrznymi a internetem i innymi połączeniami zewnętrznymi;

określenie ról i obowiązków oraz etapów specyfikacji, wdrożenia, zatwierdzenia, zmiany i przeglądu reguł zapory sieciowej i filtrów połączeń;

przeprowadzanie przeglądów architektury sieci i struktury bezpieczeństwa sieci raz w roku, a w przypadku mikroprzedsiębiorstw – okresowo, w celu zidentyfikowania potencjalnych podatności;

środki tymczasowego izolowania, w razie potrzeby, podsieci oraz elementów i urządzeń sieci;

wdrożenie bezpiecznego poziomu bazowego konfiguracji wszystkich elementów sieci oraz umacnianie sieci i urządzeń sieciowych zgodnie z wszelkimi instrukcjami dostawcy, w stosownych przypadkach, normami w rozumieniu art. 2 pkt 1 rozporządzenia (UE) nr 1025/2012 oraz wiodącymi praktykami;

procedury ograniczania, blokowania i zamykania systemu oraz sesji zdalnych po upływie określonego okresu braku aktywności;

w odniesieniu do umów o świadczenie usług sieciowych:

(i)

identyfikację i specyfikację środków bezpieczeństwa ICT i informacji, poziomów usług i wymogów w zakresie zarządzania w odniesieniu do wszystkich usług sieciowych;

(ii)

wskazanie, czy usługi te są świadczone przez dostawcę usług ICT wewnątrz grupy czy przez zewnętrznych dostawców usług ICT.

Do celów lit. h) podmioty finansowe regularnie przeprowadzają przegląd reguł zapory sieciowej i filtrów połączeń zgodnie z klasyfikacją ustanowioną zgodnie z art. 8 ust. 1 rozporządzenia (UE) 2022/2554 oraz ogólnym profilem ryzyka odpowiednich systemów ICT. W przypadku systemów ICT, które wspierają krytyczne lub istotne funkcje, podmioty finansowe weryfikują adekwatność obowiązujących reguł zapory sieciowej i filtrów połączeń co najmniej raz na sześć miesięcy.

EULAW

Artykuł 9 Ochrona i zapobieganie
-

EULAW

Artykuł 21 Środki zarządzania ryzykiem w cyberbezpieczeństwie
-

EULAW

Article 9 3

3. In order to achieve the objectives referred to in paragraph 2, financial entities shall use ICT solutions and processes that are appropriate in accordance with Article 4. Those ICT solutions and processes shall:

(a)	ensure the security of the means of transfer of data;

(b)	minimise the risk of corruption or loss of data, unauthorised access and technical flaws that may hinder business activity;

(c)	prevent the lack of availability, the impairment of the authenticity and integrity, the breaches of confidentiality and the loss of data;

(d)	ensure that data is protected from risks arising from data management, including poor administration, processing-related risks and human error.

Powiązane zgłoszenia

Powiązania
Typ powiązania	Zgłoszenie
is related to	Annual
is related to	relative Control Weighting = 09
is related to	Technology
is related to	Protect
is related to	SCRM Focus Tier 2 OPERATIONAL
is related to	SCRM Focus Tier 3 TACTICAL
blocks	Loss of Accountability / Attribution
blocks	Excessive or Unauthorized Privilege
blocks	Unauthorized Privilege Elevation
blocks	Unauthorized Access
blocks	Loss, Theft or Damage of Assets
blocks	Unauthorized Modification / Loss of System Integrity
blocks	Unauthorized Retention / Inability to Dispose of Data
blocks	Business / Service Interruption
blocks	Data Loss / Integrity Compromise
blocks	Reduced Operational Productivity
blocks	System / Data Compromise (Technical Vector)
blocks	System / Data Compromise (Non-Technical Vector)
blocks	Revenue Loss
blocks	Contractual Default / Termination
blocks	Loss of Competitive Advantage
blocks	Reputational Harm / Loss of Stakeholder Trust
blocks	Regulatory / Legal / Contractual Financial Liability
blocks	Exposure from Unaddressed Vulnerabilities
blocks	System / Service Compromise
blocks	Failure to Support Business / Mission Objectives
blocks	Unaddressed Security / Compliance Exposure
blocks	Unperformed / Unowned Control Responsibilities
blocks	Uncontrolled Internal Security / Privacy Exposure
blocks	Uncontrolled Third-Party Security / Privacy Exposure
blocks	Lack of oversight of internal controls
blocks	Lack of oversight of third-party controls
blocks	Harm from Illegal, Abusive or Unsafe Content / Conduct
blocks	Loss of Investigative / Evidentiary Capability
blocks	Delayed Containment / Increased Incident Impact
blocks	Incident Persistence / Recurrence
blocks	Incident Response / Recovery Cost
blocks	Undetected / Delayed Detection of Adverse Activity
blocks	Lack of a security-minded workforce
blocks	Third-Party Cybersecurity Compromise / Exposure
blocks	Third-Party Physical Security Disruption / Exposure
blocks	Sub-Tier / Fourth-Party Supply Chain Exposure
blocks	Third-Party Legal / Compliance Exposure
blocks	Harm from Unauthorized / Unintended Product or Service Use
blocks	Third-Party Dependency Failure
blocks	Accessibility Features
blocks	PowerShell Profile
blocks	Application Access Token
blocks	Subvert Trust Controls
blocks	Install Root Certificate
blocks	Inter-Process Communication
blocks	Dynamic Data Exchange
is related to	relative Control Weighting = 10
is related to	Process
is related to	SCRM Focus Tier 1 STRATEGIC
blocks	Data Obfuscation
blocks	Junk Data
blocks	Steganography
blocks	Protocol or Service Impersonation
blocks	OS Credential Dumping
blocks	LSASS Memory
blocks	Security Account Manager
blocks	NTDS
blocks	LSA Secrets
blocks	Cached Domain Credentials
blocks	DCSync
blocks	Proc Filesystem
blocks	/etc/passwd and /etc/shadow
blocks	Fallback Channels
blocks	Exfiltration Over Other Network Medium
blocks	Exfiltration Over Bluetooth
blocks	Traffic Duplication
blocks	Remote Services
blocks	Remote Desktop Protocol
blocks	SMB/Windows Admin Shares
blocks	Distributed Component Object Model
blocks	SSH
blocks	VNC
blocks	Windows Remote Management
blocks	Direct Cloud VM Connections
blocks	Obfuscated Files or Information
blocks	Command Obfuscation
blocks	Scheduled Transfer
blocks	Data Transfer Size Limits
blocks	Masquerading
blocks	Invalid Code Signature
blocks	Rename Legitimate Utilities
blocks	Match Legitimate Resource Name or Location
blocks	Double File Extension
blocks	Masquerade Account Name
blocks	Boot or Logon Initialization Scripts
blocks	Login Hook
blocks	Network Logon Script
blocks	RC Scripts
blocks	Startup Items
blocks	Network Service Discovery
blocks	Windows Management Instrumentation
blocks	Exfiltration Over Alternative Protocol
blocks	Exfiltration Over Symmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
blocks	Exfiltration Over Unencrypted Non-C2 Protocol
blocks	Exfiltration Over Physical Medium
blocks	Exfiltration over USB
blocks	Scheduled Task/Job
blocks	At
blocks	Cron
blocks	Scheduled Task
blocks	Systemd Timers
blocks	Process Injection
blocks	Ptrace System Calls
blocks	Web Portal Capture
blocks	Command and Scripting Interpreter
blocks	PowerShell
blocks	AppleScript
blocks	Windows Command Shell
blocks	Unix Shell
blocks	Visual Basic
blocks	Python
blocks	JavaScript
blocks	Network Device CLI
blocks	AutoHotKey & AutoIT
blocks	Lua
blocks	Exploitation for Privilege Escalation
blocks	Indicator Removal
blocks	Clear Command History
blocks	Clear Network Connection History and Configurations
blocks	Clear Mailbox Data
blocks	Clear Persistence
blocks	Application Layer Protocol
blocks	Web Protocols
blocks	File Transfer Protocols
blocks	Mail Protocols
blocks	DNS
blocks	Software Deployment Tools
blocks	Valid Accounts
blocks	Domain Accounts
blocks	Local Accounts
blocks	Cloud Accounts
blocks	Taint Shared Content
blocks	Account Discovery
blocks	Local Account
blocks	Domain Account
blocks	Proxy
blocks	Internal Proxy
blocks	External Proxy
blocks	Multi-hop Proxy
blocks	Replication Through Removable Media
blocks	Communication Through Removable Media
blocks	Non-Application Layer Protocol
blocks	Account Manipulation
blocks	Additional Cloud Credentials
blocks	Additional Email Delegate Permissions
blocks	Additional Cloud Roles
blocks	SSH Authorized Keys
blocks	Device Registration
blocks	Additional Local or Domain Groups
blocks	Web Service
blocks	Dead Drop Resolver
blocks	Bidirectional Communication
blocks	One-Way Communication
blocks	Multi-Stage Channels
blocks	Ingress Tool Transfer
blocks	Native API
blocks	Brute Force
blocks	Password Guessing
blocks	Password Cracking
blocks	Password Spraying
blocks	Credential Stuffing
blocks	Multi-Factor Authentication Interception
blocks	Email Collection
blocks	Remote Email Collection
blocks	Email Forwarding Rule
blocks	Automated Collection
blocks	Trusted Developer Utilities Proxy Execution
blocks	MSBuild
blocks	ClickOnce
blocks	Shared Modules
blocks	Data Encoding
blocks	Standard Encoding
blocks	Non-Standard Encoding
blocks	External Remote Services
blocks	Access Token Manipulation
blocks	Token Impersonation/Theft
blocks	Create Process with Token
blocks	Make and Impersonate Token
blocks	SID-History Injection
blocks	Network Share Discovery
blocks	Create Account
blocks	Local Account
blocks	Domain Account
blocks	Cloud Account
blocks	Office Application Startup
blocks	Office Template Macros
blocks	Office Test
blocks	Outlook Forms
blocks	Outlook Home Page
blocks	Outlook Rules
blocks	Add-ins
blocks	Software Extensions
blocks	Browser Session Hijacking
blocks	Forced Authentication
blocks	Drive-by Compromise
blocks	Exploit Public-Facing Application
blocks	Supply Chain Compromise
blocks	Compromise Software Dependencies and Development Tools
blocks	Compromise Hardware Supply Chain
blocks	BITS Jobs
blocks	Trusted Relationship
blocks	Password Policy Discovery
blocks	User Execution
blocks	Malicious Link
blocks	Malicious File
blocks	Malicious Image
blocks	Traffic Signaling
blocks	Port Knocking
blocks	Exploitation of Remote Services
blocks	Exploitation for Stealth
blocks	Exploitation for Credential Access
blocks	Data from Information Repositories
blocks	Confluence
blocks	Sharepoint
blocks	Customer Relationship Management Software
blocks	Messaging Applications
blocks	System Script Proxy Execution
blocks	PubPrn
blocks	SyncAppvPublishingServer
blocks	System Binary Proxy Execution
blocks	Compiled HTML File
blocks	Control Panel
blocks	CMSTP
blocks	InstallUtil
blocks	Mshta
blocks	Msiexec
blocks	Odbcconf
blocks	Regsvcs/Regasm
blocks	Verclsid
blocks	Mavinject
blocks	MMC
blocks	Electron Applications
blocks	Remote Access Tools
blocks	XSL Script Processing
blocks	Template Injection
blocks	File and Directory Permissions Modification
blocks	Windows Permissions
blocks	Linux and Mac Permissions
blocks	Domain Trust Discovery
blocks	Domain or Tenant Policy Modification
blocks	Data Destruction
blocks	Data Encrypted for Impact
blocks	Service Stop
blocks	Inhibit System Recovery
blocks	Defacement
blocks	Internal Defacement
blocks	External Defacement
blocks	Firmware Corruption
blocks	Network Denial of Service
blocks	Direct Network Flood
blocks	Reflection Amplification
blocks	Endpoint Denial of Service
blocks	OS Exhaustion Flood
blocks	Service Exhaustion Flood
blocks	Application Exhaustion Flood
blocks	Application or System Exploitation
blocks	Server Software Component
blocks	SQL Stored Procedures
blocks	Transport Agent
blocks	Web Shell
blocks	IIS Components
blocks	Terminal Services DLL
blocks	Implant Internal Image
blocks	Steal Application Access Token
blocks	Data from Cloud Storage
blocks	Transfer Data to Cloud Account
blocks	Steal Web Session Cookie
blocks	Pre-OS Boot
blocks	System Firmware
blocks	Bootkit
blocks	ROMMONkit
blocks	TFTP Boot
blocks	Create or Modify System Process
blocks	Launch Agent
blocks	Systemd Service
blocks	Windows Service
blocks	Launch Daemon
blocks	Event Triggered Execution
blocks	Screensaver
blocks	Windows Management Instrumentation Event Subscription
blocks	Unix Shell Configuration Modification
blocks	LC_LOAD_DYLIB Addition
blocks	AppInit DLLs
blocks	Emond
blocks	Installer Packages
blocks	Authentication Package
blocks	Time Providers
blocks	Security Support Provider
blocks	Kernel Modules and Extensions
blocks	Re-opened Applications
blocks	LSASS Driver
blocks	Shortcut Modification
blocks	XDG Autostart Entries
blocks	Abuse Elevation Control Mechanism
blocks	Setuid and Setgid
blocks	Bypass User Account Control
blocks	Sudo and Sudo Caching
blocks	Elevated Execution with Prompt
blocks	TCC Manipulation
blocks	Use Alternate Authentication Material
blocks	Pass the Hash
blocks	Pass the Ticket
blocks	Unsecured Credentials
blocks	Credentials In Files
blocks	Credentials in Registry
blocks	Shell History
blocks	Private Keys
blocks	Cloud Instance Metadata API
blocks	Group Policy Preferences
blocks	Container API
blocks	Gatekeeper Bypass
blocks	SIP and Trust Provider Hijacking
blocks	Mark-of-the-Web Bypass
blocks	Code Signing Policy Modification
blocks	Compromise Host Software Binary
blocks	Windows Credential Manager
blocks	Password Managers
blocks	Modify Authentication Process
blocks	Domain Controller Authentication
blocks	Password Filter DLL
blocks	Pluggable Authentication Modules
blocks	Network Device Authentication
blocks	Network Provider DLL
blocks	Conditional Access Policies
blocks	Adversary-in-the-Middle
blocks	Name Resolution Poisoning and SMB Relay
blocks	ARP Cache Poisoning
blocks	DHCP Spoofing
blocks	Evil Twin
blocks	Steal or Forge Kerberos Tickets
blocks	Golden Ticket
blocks	Silver Ticket
blocks	Kerberoasting
blocks	AS-REP Roasting
blocks	Component Object Model
blocks	XPC Services
blocks	Archive Collected Data
blocks	Archive via Utility
blocks	Disk Wipe
blocks	Disk Content Wipe
blocks	Disk Structure Wipe
blocks	Remote Service Session Hijacking
blocks	SSH Hijacking
blocks	RDP Hijacking
blocks	Hidden Users
blocks	Run Virtual Instance
blocks	VBA Stomping
blocks	Resource Forking
blocks	Data Manipulation
blocks	Stored Data Manipulation
blocks	Transmitted Data Manipulation
blocks	Runtime Data Manipulation
blocks	Phishing
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	System Services
blocks	Service Execution
blocks	Lateral Tool Transfer
blocks	Non-Standard Port
blocks	Protocol Tunneling
blocks	Encrypted Channel
blocks	Symmetric Cryptography
blocks	Asymmetric Cryptography
blocks	Hijack Execution Flow
blocks	DLL
blocks	Dylib Hijacking
blocks	Executable Installer File Permissions Weakness
blocks	Dynamic Linker Hijacking
blocks	Path Interception by PATH Environment Variable
blocks	Path Interception by Search Order Hijacking
blocks	Path Interception by Unquoted Path
blocks	Services File Permissions Weakness
blocks	KernelCallbackTable
blocks	AppDomainManager
blocks	Modify Cloud Compute Infrastructure
blocks	Create Snapshot
blocks	Create Cloud Instance
blocks	Delete Cloud Instance
blocks	DNS
blocks	Phishing for Information
blocks	Spearphishing Attachment
blocks	Spearphishing Link
blocks	Network Boundary Bridging
blocks	Network Address Translation Traversal
blocks	Modify System Image
blocks	Patch System Image
blocks	Downgrade System Image
blocks	Data from Configuration Repository
blocks	SNMP (MIB Dump)
blocks	Network Device Configuration Dump
blocks	Container Administration Command
blocks	Deploy Container
blocks	Escape to Host
blocks	Build Image on Host
blocks	Container and Resource Discovery
blocks	Debugger Evasion
blocks	Plist File Modification
blocks	Serverless Execution
blocks	Power Settings
blocks	Inability to Demonstrate Due Diligence / Due Care
blocks	Loss of Confidentiality
blocks	Loss of Data Integrity
blocks	Drought & Water Shortage
blocks	Earthquakes
blocks	Fire & Wildfires
blocks	Floods
blocks	Hurricanes & Tropical Storms
blocks	Landslides & Debris Flow
blocks	Pandemic (Disease) Outbreaks
blocks	Severe Weather
blocks	Space Weather
blocks	Thunderstorms & Lightning
blocks	Tornadoes
blocks	Tsunamis
blocks	Volcanoes
blocks	Winter Storms & Extreme Cold
blocks	Malicious Cyber Activity
blocks	Dysfunctional Management Practices
blocks	Human Error
blocks	Technical / Mechanical Failure
blocks	Statutory / Regulatory / Contractual Change
blocks	Fraud, Corruption and/or Intentional Criminal Conduct
blocks	Product Defect / Design Failure
blocks	Workforce Shortage / Loss of Critical Skills / Labor Disruption
blocks	AM-05.01B
blocks	AM-06.02B
blocks	OPS-05.01AC
blocks	OPS-26.01B
blocks	OPS-26.02B
blocks	OPS-26.03B
blocks	OPS-34.02B
blocks	OPS-35.01B
blocks	PSS-01.02B
blocks	PSS-11.01B
is blocked by	CFG-04 Secure Baseline Configurations – Assessment Procedure
blocks	CM-02 Baseline Configuration
blocks	CM-06 Configuration Settings
blocks	PL-10 Baseline Selection
blocks	SA-08 Security and Privacy Engineering Principles
blocks	SA-15(05) Attack Surface Reduction
blocks	CM-02 [L] Baseline Configuration
blocks	CM-06 [L] Configuration Settings
blocks	PL-10 [L] Baseline Selection
blocks	SA-08 [L] Security and Privacy Engineering Principles
blocks	CM-02 [M] Baseline Configuration
blocks	CM-06 [M] Configuration Settings
blocks	PL-10 [M] Baseline Selection
blocks	SA-08 [M] Security and Privacy Engineering Principles
blocks	CM-02 [H] Baseline Configuration
blocks	CM-06 [H] Configuration Settings
blocks	PL-10 [H] Baseline Selection
blocks	SA-08 [H] Security and Privacy Engineering Principles
blocks	03.01.01 Account Management
blocks	03.01.03 Information Flow Enforcement
blocks	03.01.08 Unsuccessful Logon Attempts
blocks	03.01.09 System Use Notification
blocks	03.01.10 Device Lock
blocks	03.01.11 Session Termination
blocks	03.01.12 Remote Access
blocks	03.01.16 Wireless Access
blocks	03.01.18 Access Control for Mobile Devices
blocks	03.03.08 Protection of Audit Information
blocks	03.04.01 Baseline Configuration
blocks	03.04.02 Configuration Settings
blocks	03.04.06 Least Functionality
blocks	03.05.04 Replay-Resistant Authentication
blocks	03.05.07 Password Management
blocks	03.05.12 Authenticator Management
blocks	03.07.05 Nonlocal Maintenance
blocks	03.08.07 Media Use
blocks	03.13.12 Collaborative Computing Devices and Applications
blocks	PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected
blocks	PR.PS Platform Security
blocks	PR.PS-05 Installation and execution of unauthorized software are prevented
blocks	PO.5.2 Secure and harden development endpoints (i.e., endpoints for software designers, developers, testers, builders, etc.) to perform development-related …
blocks	PW.9.1 Define a secure baseline by determining how to configure each setting that has an effect on security or a security-related setting so that the …

Secure Controls Framework -
The Secure Controls Framework® (SCF)

"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.

The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.

Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.

The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/

Terms & Conditions

The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.